CVE-2021-28125

Description

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

How to fix CVE-2021-28125

To remediate CVE-2021-28125, upgrade the affected package to a fixed version below.

• —upgrade to 1.0.2 or later
• —upgrade to 1.1.0 or later
• —upgrade to 1.1.0 or later
• —no fix listed
• —no fix listed

Is CVE-2021-28125 being exploited?

Likely — EPSS is 63.8%, placing CVE-2021-28125 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (5)

• from 0, < 1.0.2
• from 0, < 1.1.0
• from 0, < 1.1.0
• from 0, <= 0.34.0
• from 0, <= 0.34.0

CVSS scores

References (9)

• ADVISORYgithub.com/advisories/GHSA-pfwg-rxf4-97c3
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-28125
• PATCHgithub.com/apache/superset
• PATCHpypi.org/project/superset
• WEBwww.openwall.com/lists/oss-security/2021/04/27/2