CVE-2022-43717

{"id": "CVE-2022-43717", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2023-01-16T11:15:10.370", "references": [{"url": "https://lists.apache.org/thread/g6zy6vkpvkbj5mj32vmyzwol5ldtg9pl", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/g6zy6vkpvkbj5mj32vmyzwol5ldtg9pl", "tags": ["Mailing List", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions.\u00a0This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0."}, {"lang": "es", "value": "La representaci\u00f3n del panel no sanitiza suficientemente el contenido de los componentes de rebajas, lo que genera posibles vectores de ataque XSS que pueden realizar usuarios autenticados con permisos para crear panel. Este problema afecta a Apache Superset versi\u00f3n 1.5.2 y versiones anteriores y a la versi\u00f3n 2.0.0."}], "lastModified": "2024-11-21T07:27:07.367", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD514249-ED9E-45F1-9D50-4A7CE6DB166B", "versionEndIncluding": "1.5.2"}, {"criteria": "cpe:2.3:a:apache:superset:2.0.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35CD3C6F-B3E0-437C-A1D7-EF700C76923C"}, {"criteria": "cpe:2.3:a:apache:superset:2.0.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADD3485B-3FFC-4B60-89F5-E4ECA0C680B6"}, {"criteria": "cpe:2.3:a:apache:superset:2.0.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC060A49-79ED-4539-9E68-EDB15D7F2445"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}