Open Redirect in Apache Superset

MÉDIO 6.1CVE-2021-28125 · BIT-superset-2021-28125 · GHSA-pfwg-rxf4-97c3 · Published 27/04/2021 · updated 17/06/2026

Em resumo

CVE-2021-28125 é uma vulnerabilidade MÉDIO (CVSS 6.1) que afeta apache-superset, superset, superset (apache).
Chance de exploração nos próximos 30 dias (EPSS): 64.0%, maior que 99.2% das vulnerabilidades.
Correção: atualize para 1.1.0 ou posterior.

Package	Affected versions	Patched versions
apache-superset PyPI	`< 1.1.0`	`1.1.0`
superset PyPI	`≤ 0.34.0`	No fix yet
superset apache	`≤ 1.0.1`	No fix yet

Description

Apache Superset prior to 1.1.0 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

NVD description

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.