Lucene search

GitHub Advisory DatabaseGHSA-7222-R37X-8Q3M

HistoryJan 16, 2023 - 12:30 p.m.

Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints

2023-01-1612:30:18

CWE-352

GitHub Advisory Database

github.com

apache superset

csrf

vulnerability

rest api

legacy

version 1.5.2

version 2.0.0

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.005

Percentile

77.7%

JSON

Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected configurations

Vulners

Node

apachesupersetMatch2.0.0

apachesupersetRange≤1.5.2

VendorProductVersionCPE
apachesuperset2.0.0cpe:2.3:a:apache:superset:2.0.0:*:*:*:*:*:*:*
apachesuperset*cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	superset	2.0.0	cpe:2.3:a:apache:superset:2.0.0:::::::*
apache	superset	*	cpe:2.3:a:apache:superset::::::::

References

github.com/advisories/GHSA-7222-r37x-8q3m

lists.apache.org/thread/xc309h2dphrkg33154djf3nqlh2xc1c0

nvd.nist.gov/vuln/detail/CVE-2022-43719

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.005

Percentile

77.7%

JSON

Related for GHSA-7222-R37X-8Q3M