Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1wZndnLXJ4ZjQtOTdjM80WMg

Open Redirect in Apache Superset

Apache Superset prior to 1.1.0 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

Permalink: https://github.com/advisories/GHSA-pfwg-rxf4-97c3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wZndnLXJ4ZjQtOTdjM80WMg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: about 1 year ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-pfwg-rxf4-97c3, CVE-2021-28125
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-28125
• https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E
• https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434@%3Cdev.superset.apache.org%3E
• http://www.openwall.com/lists/oss-security/2021/04/27/2
• https://github.com/apache/superset/commit/eb35b804acf4d84cb70d02743e04b8afebbee029
• https://github.com/advisories/GHSA-pfwg-rxf4-97c3
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-128.yaml

Repository: https://github.com/apache/superset
Blast Radius: 8.2

Affected Packages