Medium
Apache Superset: Open Redirect Vulnerability
Type: advisorySources: OSV
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-43721
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 17:39 UTC · Revision 1
Source evidence
Apache Superset: Open Redirect Vulnerability
core-osv · Original sourcePublished 16 Jan 2023, 10:10 UTC
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
osv:CVE-2022-43721
Complete source record
{
"id": "906b6a6c3485e2e951ae8db944602de7acac14383576cdabd748567d12f5bdf0",
"url": "https://osv.dev/vulnerability/CVE-2022-43721",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Apache Superset: Open Redirect Vulnerability",
"summary": "An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.",
"evidence": "osv:CVE-2022-43721",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2022-43721",
"aliases": [
"BIT-superset-2022-43721",
"CVE-2022-43721",
"GHSA-fcg4-pm6h-9xx2",
"PYSEC-2026-781"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/superset",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0c05300ce51b721e88870565833f72a3337cc300"
},
{
"introduced": "067495d954ee0015d35c1437245feb66984e4c49"
},
{
"last_affected": "edbbf886af53009676a1fae32fc024efa2d68534"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.5.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:superset:2.0.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-NA"
},
{
"last_affected": "2.0.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:superset:2.0.0:rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-rc2"
},
{
"last_affected": "2.0.0-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:superset:2.0.0:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-rc1"
},
{
"last_affected": "2.0.0-rc1"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.0.0-NA",
"2.0.0-rc1",
"1.5.2rc3",
"1.5.2",
"1.5.2rc2",
"1.5.2rc1",
"2.0.0rc1",
"1.5.1rc1",
"1.5.1",
"superset-helm-chart-0.6.3",
"1.5.0rc4",
"1.5.0",
"superset-helm-chart-0.6.2",
"superset-helm-chart-0.6.1",
"1.5.0rc3",
"superset-helm-chart-0.6.0",
"1.5.0rc2",
"1.5.0rc1",
"superset-helm-chart-0.5.10",
"superset-helm-chart-0.5.9",
"superset-helm-chart-0.5.8",
"superset-helm-chart-0.5.7",
"superset-helm-chart-0.5.6",
"superset-helm-chart-0.5.5",
"superset-helm-chart-0.5.4",
"superset-helm-chart-0.5.3",
"superset-helm-chart-0.5.2",
"superset-helm-chart-0.5.1",
"superset-helm-chart-0.5.0",
"superset-helm-chart-0.4.0",
"superset-helm-chart-0.3.12",
"v2021.40.0",
"superset-helm-chart-0.3.11",
"v2021.41.0",
"superset-helm-chart-0.3.10",
"superset-helm-chart-0.3.9",
"v2021.38.0",
"v2021.36.5",
"superset-helm-chart-0.3.8",
"superset-helm-chart-0.3.7",
"v2021.36.0",
"v2021.35.0",
"v2021.34.0",
"superset-helm-chart-0.3.6",
"v2021.31.0",
"v2021.29.0",
"superset-helm-chart-0.3.5",
"v2021.27.1",
"v2021.27.0",
"superset-helm-chart-0.3.4",
"superset-helm-chart-0.3.3",
"superset-helm-chart-0.3.2",
"superset-helm-chart-0.3.1",
"superset-helm-chart-0.3.0",
"superset-helm-chart-0.2.1",
"superset-helm-chart-0.2.0",
"v2021.25.0",
"superset-helm-chart-0.1.6",
"superset-helm-chart-0.1.5",
"v2021.23.1",
"v2021.24.0",
"superset-helm-chart-0.1.4",
"v2021.23.0",
"v2021.21.0",
"v2021.22.0",
"superset-helm-chart-0.1.3",
"v2021.19.0",
"v2021.20.0",
"v2021.18.0",
"v2021.17.0",
"superset-helm-chart-0.1.2",
"v2021.15.0",
"superset-helm-chart-0.1.1",
"superset-helm-chart-0.1.0",
"v2021.13.0",
"v2021.10.0",
"v2021.9.4",
"v2021.8.0",
"v2021.9.0",
"v2021.7.0",
"v2021.6.0",
"v2021.5.1",
"v2021.5.0",
"v2021.3.0",
"2020.51.1",
"v2020.51.0",
"test_tag",
"0.29.0rc1",
"0.25-fork",
"0.20.1",
"0.19.1",
"0.18.5",
"0.18.4",
"0.18.3",
"0.18.2",
"0.17.6",
"0.17.5",
"0.17.4",
"0.17.3",
"0.17.2",
"0.17.1",
"airbnb_prod.0.15.5.0",
"0.17.0",
"0.16.1",
"0.16.0",
"airbnb_prod.0.15.4.2",
"airbnb_prod.0.15.4.1",
"0.15.4.1",
"0.15.4",
"0.15.3",
"0.15.1",
"airbnb_prod.0.15.0.1",
"0.15.0",
"airbnb_prod.0.13.0.3",
"airbnb_prod.0.13.0.2",
"airbnb_prod.0.13.0.1",
"0.14.1",
"airbnb_prod.0.13.0.0",
"airbnb_prod.0.12.1.0",
"airbnb_prod.0.12.0.1",
"0.13.2",
"0.13.1",
"0.12.0",
"airbnb_prod.0.11.0.6",
"airbnb_prod.0.11.0.5",
"airbnb_prod.0.11.0.4",
"airbnb_prod.0.11.0.3",
"dummy",
"airbnb_prod.0.11.0.2",
"airbnb_prod.0.11.0.1",
"0.11.0",
"airbnb_prod.0.10.0.2",
"0.10.0",
"0.9.1",
"0.9.0",
"0.8.9",
"0.8.8",
"0.8.7",
"0.8.6",
"0.8.5",
"0.8.4",
"0.8.3",
"0.8.0",
"0.7.0",
"0.6.1",
"0.6.0",
"0.5.3",
"0.5.2",
"0.5.1",
"rm",
"0.5.0",
"0.4.0",
"0.2.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-43721.json"
}
}
],
"modified": "2026-10-28T02:30:47.759896887Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43721.json",
"https://lists.apache.org/thread/s6sqt5jmcv6qxtvdot1t5tpt57v439kg",
"https://nvd.nist.gov/vuln/detail/CVE-2022-43721"
],
"provider_metadata": {
"cwe_ids": [
"CWE-601"
],
"cna_assigner": "apache",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.1"
},
{
"last_affected": "1.5.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43721.json"
}
},
"related_cves": [
{
"value": "CVE-2022-43721",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 515811,
"published_at": "2023-01-16T10:10:52.583+00:00"
}