VULNERABILITY INTELLIGENCE

CVE-2023-42502

CVSS score4.8 MEDIUM
EPSS probability0.83%
CISA KEVNot currently listed
Published2023-11-28
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Description

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

Weakness classification

  • security@apache.org: CWE-601

Primary references