CVE-2023-42502

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Nov 28, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-425035.5Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects ApacCVE-2023-425046.5An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possibCVE-2023-425054.3An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connCVE-2023-425067.8Improper restriction of operations within the bounds of a memory buffer issue exists in OnSinView2 versions 2.0.1 and earlier. If this vulneCVE-2023-425077.8Stack-based buffer overflow vulnerability exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information mCVE-2023-425086.5JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unautCVE-2023-425097.5JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled eCVE-2023-42514.3The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged inCVE-2023-42525.3The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookiCVE-2023-425207.5Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. This affects WithSecure Client SeCVE-2023-425217.5Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. This affects WithSecure Client SeCVE-2023-425227.5Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. This affects WithSecu