CVE-2022-43718

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Superset	>= 2.0.0, < 2.0.1; <= 1.5.2

References

https://lists.apache.org/thread/8615608jt2x7b3rmqrtngldy8pn3nz2rMailing List, Vendor Advisory
https://lists.apache.org/thread/8615608jt2x7b3rmqrtngldy8pn3nz2rMailing List, Vendor Advisory

Timeline

Published: Jan 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-437198.8Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Supers CVE-2022-43727.2The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading CVE-2022-437205.4An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped CVE-2022-437215.4An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to thi CVE-2022-437227.8A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing l CVE-2022-437237.5A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software d CVE-2022-437249.8A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inb CVE-2022-43737.2The Quote-O-Matic WordPress plugin through 1.0.5 does not properly sanitize and escape a parameter before using it in a SQL statement, leadi CVE-2022-43746.1The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, lead CVE-2022-437407.5IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. I CVE-2022-437479.8baramundi Management Agent (bMA) in baramundi Management Suite (bMS) 2021 R1 and R2 and 2022 R1 allows remote code execution. This is fixed CVE-2022-437487.5Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto