Apache Software Foundation Superset 2.0.0 Release Candidate 1
Approved changes feed: RSS · Atom
cpe:2.3:a:apache:superset:2.0.0:rc1:*:*:*:*:*:*
part: a version: 2.0.0 update: rc1
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Superset (3ae3dbbe-802f-5dfd-aef5-3d02c7073503) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/superset |
purl2cpe | 2026-06-01 10:14:31.704669 |
pkg:docker/apache/superset |
purl2cpe | 2026-06-01 10:14:31.704670 |
pkg:github/apache/superset |
purl2cpe | 2026-06-01 10:14:31.704672 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-45438 |
vulnerable | 2026-06-08 05:50:36.344016 |
Apache Superset: Dashboard metadata information leak
When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Published: 2023-01-16T10:12:02.872Z
Updated: 2025-04-07T14:59:56.105Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-43721 |
vulnerable | 2026-06-08 05:49:33.953016 |
Apache Superset: Open Redirect Vulnerability
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Published: 2023-01-16T10:10:52.583Z
Updated: 2025-04-07T15:01:48.626Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-43720 |
vulnerable | 2026-06-08 05:49:33.952360 |
Apache Superset: Improper rendering of user input
An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Published: 2023-01-16T10:10:41.565Z
Updated: 2025-04-07T15:03:05.455Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-43719 |
vulnerable | 2026-06-08 05:49:33.951794 |
Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API
Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Published: 2023-01-16T10:10:27.487Z
Updated: 2025-04-07T15:04:38.899Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-43718 |
vulnerable | 2026-06-08 05:49:33.951039 |
Apache Superset: Cross-Site Scripting vulnerability on upload forms
Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Published: 2023-01-16T10:10:04.630Z
Updated: 2025-04-07T15:06:28.119Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-43717 |
vulnerable | 2026-06-08 05:49:33.949703 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-41703 |
vulnerable | 2026-06-08 05:48:30.821192 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.