Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-43720

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Published

2023-01-16T11:15:10.587

Last Modified

2025-04-07T15:15:41.140

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.4 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-74
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache superset ≤ 1.5.2 Yes
Application apache superset 2.0.0 Yes
Application apache superset 2.0.0 Yes
Application apache superset 2.0.0 Yes
References