CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
10.7%
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS.
For 2.X versions, users should change their config to include:
TALISMAN_CONFIG = {
“content_security_policy”: {
“base-uri”: [“‘self’”],
“default-src”: [“‘self’”],
“img-src”: [“‘self’”, “blob:”, “data:”],
“worker-src”: [“‘self’”, “blob:”],
“connect-src”: [
“‘self’”,
" https://api.mapbox.com" https://api.mapbox.com" ;,
" https://events.mapbox.com" https://events.mapbox.com" ;,
],
“object-src”: “‘none’”,
“style-src”: [
“‘self’”,
“‘unsafe-inline’”,
],
“script-src”: [“‘self’”, “‘strict-dynamic’”],
},
“content_security_policy_nonce_in”: [“script-src”],
“force_https”: False,
“session_cookie_secure”: False,
}