CVE-2023-42502

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Superset	< 3.0.0

References

https://lists.apache.org/thread/n8348f194d8o8mln3oxd0s8jdl5bxbmnMailing List, Third Party Advisory
https://lists.apache.org/thread/n8348f194d8o8mln3oxd0s8jdl5bxbmnMailing List, Third Party Advisory

Timeline

Published: Nov 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-425035.5Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apac CVE-2023-425046.5An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possib CVE-2023-425054.3An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the conn CVE-2023-425067.8Improper restriction of operations within the bounds of a memory buffer issue exists in OnSinView2 versions 2.0.1 and earlier. If this vulne CVE-2023-425077.8Stack-based buffer overflow vulnerability exists in OnSinView2 versions 2.0.1 and earlier. If this vulnerability is exploited, information m CVE-2023-425086.5JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unaut CVE-2023-425097.5JFrog Artifactory later than version 7.17.4 but prior to version 7.77.0 is vulnerable to an issue whereby a sequence of improperly handled e CVE-2023-42514.3The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in CVE-2023-42525.3The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase booki CVE-2023-425207.5Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. This affects WithSecure Client Se CVE-2023-425217.5Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. This affects WithSecure Client Se CVE-2023-425227.5Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. This affects WithSecu