Medium · 6.5 CVE-2021-42250 BIT-superset-2021-42250EUVD-2021-0024GHSA-5fp8-c45m-256pPYSEC-2021-435

Possible log injection

Published Nov 17, 2021 · Updated Aug 4, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Superset Package: apache-superset Ecosystem: PyPI

Description

Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Superset	Apache Superset – ≤ 1.3.1	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
PyPI	apache-superset	< 1.3.2	1.3.2	GHSA-5fp8-c45m-256p

References

https://lists.apache.org/thread/53lkszw6d3tybp5t99nvgcj538b9trw9
[oss-security] 20211117 CVE-2021-42250: Apache Superset: Possible log injection mailing-list