CVE-2022-43721

Name of the Vulnerable Software and Affected Versions Apache Superset versions 1.5.2 and prior Apache Superset version 2.0.0

Description An authenticated attacker with update datasets permission could change a dataset link to an untrusted site. Users could be redirected to this site when clicking on that specific dataset.

Recommendations For Apache Superset versions 1.5.2 and prior, consider restricting the update datasets permission to trusted users until a patch is available. For Apache Superset version 2.0.0, consider restricting the update datasets permission to trusted users until a patch is available. As a temporary workaround, consider monitoring and validating dataset links to prevent redirection to untrusted sites.