PyPI/apache-superset CVE-2021-28125: unknown, EPSS 64.02%
Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow
Action: Upgrade apache-superset to 1.1.0 or later.
pip install apache-superset==1.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.0 | - |
Fixed versions
| 1.1.0 |
Sources
- osv: PYSEC-2021-128
- https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E
- https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434@%3Cdev.superset.apache.org%3E
- http://www.openwall.com/lists/oss-security/2021/04/27/2
- https://github.com/advisories/GHSA-pfwg-rxf4-97c3
CVE-2021-28125 · published · modified · JSON