UpHeron
All vulnerabilities

Servers and applications

CVE-2023-42502

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

Severity
Medium 5.4
Published
28 Nov 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.0.0
Sources
NVD

Affected software

SoftwareAffected versions
Apache SupersetServers and applications · cpe:a:apache:superset
  • Every version before 3.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-42502
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-42502