Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 4 Mar 2021 15:08:16 +0000
From: daniel gaspar <>
Subject: CVE-2021-27907: Apache Superset stored XSS on Dashboard markdown


Apache Superset  up to and including 0.38.0 allowed the creation of a
Markdown component on a Dashboard page for describing chart's related
information. Abusing this functionality, a malicious user could inject
javascript code executing unwanted action in the context of the user's
browser. The javascript code will be automatically executed (Stored
XSS) when a legitimate user surfs on the dashboard page. The
vulnerability is exploitable creating a “div” section and embedding in
it a “svg” element with javascript code.


This issue was reported by Gianluca Veltri and Dario Castrogiovanni of Cuebiq

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.