CVE-2022-43719highCWE-352

CVE-2022-43719: high-severity vulnerability in Apache Superset

Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API

Published · Updated

Follow this CVE+ Monitor Apache Superset+ Monitor apache-superset

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.6%
Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Superset
Related CVEs — Apache Superset

In the same product, most dangerous first.

CVE-2023-27524HIGHApache Superset: Session validation vulnerability when using provided default SECRET_KEYEPSS 98.1%KEVCVE-2021-27907—Apache Superset stored XSS on Dashboard markdownEPSS 86.4%CVE-2023-39265LOWApache Superset: Possible Unauthorized Registration of SQLite Database ConnectionsEPSS 86.0%CVE-2021-28125—Apache Superset Open RedirectEPSS 64.0%CVE-2023-37941MEDIUMApache Superset: Metadata db write access can lead to remote code executionEPSS 35.5%CVE-2021-44451—API sensitive information leakEPSS 7.9%