CVE-2022-43720: Improper Neutralization of Escape, Meta, or Control Sequences

January 16, 2023 (updated November 7, 2023)

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

References

lists.apache.org/thread/jts6x56kghr9mbowb653bk70pl81jp8l
nvd.nist.gov/vuln/detail/CVE-2022-43720

Code Behaviors & Features

Detect and mitigate CVE-2022-43720 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →