CVE-2023-42502
Assigner: apache
Published: 2023-11-28T16:25:43.177Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Superset
vendor: Apache Software Foundation
versions: lessThan: 3.0.0
status: affected
version: 0
versionType: semver
credits: type: finder
value: Amit Laish – GE Vernova
descriptions: supportingMedia: base64: no
type: text/html
value: An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the <span style="background-color: rgb(255, 255, 255);">HTTP Host header</span>, users could be redirected to this site when clicking on that specific dataset. <span style="background-color: rgb(255, 255, 255);">This issue affects Apache Superset versions before 3.0.0.</span><br>
value: An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
type: CWE
source: discovery: UNKNOWN
title: Apache Superset: Open Redirect Vulnerability
x_generator: engine: Vulnogram 0.1.0-dev