CVE-2021-28125

CVE-2021-28125: Apache Superset Open Redirect

Vendor Apache Software Foundation
Product Apache Superset
Weakness CWE-601 · Open redirect
Published April 27, 2021
Last update August 3, 2024

CVSS base score

What the vulnerability does

01Description

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

Key dates

02Disclosure timeline

April 27, 2021 CVE published
August 3, 2024 Record updated