A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS.
For 2.X versions, users should change their config to include:
TALISMAN_CONFIG = {
"content_security_policy": {
"base-uri": ["'self'"],
"default-src": ["'self'"],
"img-src": ["'self'", "blob:", "data:"],
"worker-src": ["'self'", "blob:"],
"connect-src": [
"'self'",
" https://api.mapbox.com" https://api.mapbox.com" ;,
" https://events.mapbox.com" https://events.mapbox.com" ;,
],
"object-src": "'none'",
"style-src": [
"'self'",
"'unsafe-inline'",
],
"script-src": ["'self'", "'strict-dynamic'"],
},
"content_security_policy_nonce_in": ["script-src"],
"force_https": False,
"session_cookie_secure": False,
}
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/wjyvz8om9nwd396lh0bt156mtwjxpsvx | Mailing List Mitigation Vendor Advisory |
| https://lists.apache.org/thread/wjyvz8om9nwd396lh0bt156mtwjxpsvx | Mailing List Mitigation Vendor Advisory |
Configurations
History
21 Nov 2024, 08:33
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.6 |
| References | () https://lists.apache.org/thread/wjyvz8om9nwd396lh0bt156mtwjxpsvx - Mailing List, Mitigation, Vendor Advisory |
29 Jan 2024, 16:05
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache
Apache superset |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| References | () https://lists.apache.org/thread/wjyvz8om9nwd396lh0bt156mtwjxpsvx - Mailing List, Mitigation, Vendor Advisory | |
| CPE | cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:* |
29 Jan 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Jan 2024, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
23 Jan 2024, 15:47
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-23 15:15
Updated : 2024-11-21 08:33
NVD link : CVE-2023-49657
Mitre link : CVE-2023-49657
CVE.ORG link : CVE-2023-49657
JSON object : View
Products Affected
apache
- superset
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')