What is GHSA-hc74-9vjm-c9xv?

GHSA-hc74-9vjm-c9xv is a security advisory published by GitHub Security Advisories with Medium severity. Apache Superset Open Redirect vulnerability

Which CVE IDs does GHSA-hc74-9vjm-c9xv cover?

GHSA-hc74-9vjm-c9xv covers the following CVE IDs: CVE-2023-42502. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hc74-9vjm-c9xv?

GHSA-hc74-9vjm-c9xv has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-hc74-9vjm-c9xv?

GHSA-hc74-9vjm-c9xv affects 1 product, including: pip/apache-superset:\u003c 3.0.0.

GHSA-hc74-9vjm-c9xvMediumCVSS 5.4

Apache Superset Open Redirect vulnerability

Vendor

GitHub Security Advisories

Published

November 28, 2023

Last Modified

December 5, 2023

🔗 CVE IDs covered (1)

CVE-2023-42502 →

📋 Description

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

🎯 Affected products1

pip/apache-superset:< 3.0.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-42502
https://lists.apache.org/thread/n8348f194d8o8mln3oxd0s8jdl5bxbmn
http://www.openwall.com/lists/oss-security/2023/11/28/3
https://github.com/advisories/GHSA-hc74-9vjm-c9xv