Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 23 Jan 2024 16:45:39 +0100
From: Christian Fischer <>
Subject: Re: CVE-2023-49657: Apache Superset: Stored XSS in
 Dashboard Title and Chart Title


On 23.01.24 14:18, Daniel Gaspar wrote:
> Affected versions:
> - Apache Superset through 3.0.3
> *snip*
> in Apache Superset before 3.0.3

it seems there is some inconsistency in the affected / fixed versions 
mentioned here, in [1] as well as in the following part of the CVE entry 

 > affected from 0 through 3.0.3

While [3] doesn't list this CVE yet it seems 3.0.3 is the actual fixed 
version as [4] mentions a relevant entry around an XSS in a "Dashboard":

 > #21822 fix(dashboard): Prevent XSS attack vector (@agl-developer)

which links to [5] as the relevant PR.




Christian Fischer | PGP Key: 0x54F3CE5B76C597AD
Greenbone AG, Neumarkt 12, 49074 Osnabrück, Germany
Company registry: Amtsgericht Osnabrück, HRB 218768
Board of directors: Dr. Jan-Oliver Wagner (CEO), Elmar Geese
Chairman of the Supervisory Board: Lukas Grunwald

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.