CVE-2021-28125 Apache Superset Open Redirect

2021-04-2709:27:22

CWE-601

apache

www.cve.org

apache superset

open redirect

external url

malicious user

dashboard

EPSS

0.004

Percentile

74.8%

JSON

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

CNA Affected

[
  {
    "product": "Apache Superset",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.0.1",
        "status": "affected",
        "version": "Apache Superset",
        "versionType": "custom"
      }
    ]
  }
]