CVE-2021-42250
Assigner: apache
Published: 2021-11-17T15:10:10
State: PUBLISHED
affected: product: Apache Superset
vendor: Apache Software Foundation
versions: lessThanOrEqual: 1.3.1
status: affected
version: Apache Superset
versionType: custom
credits: value: Found and reported by Duxiaoman Financial Security Team
descriptions: value: Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.
problemTypes: descriptions: cweId: CWE-117
description: CWE-117 Improper Output Neutralization for Logs
type: CWE
source: discovery: UNKNOWN
title: Possible log injection
workarounds: value: Upgrade to Apache Superset 1.3.2 or higher
x_generator: engine: Vulnogram 0.0.9