Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-43719: Apache Superset allows unauthorized actions via forged requests

CVE-2022-43719 · published 3 years ago

Summary

Two older web‑API functions in Apache Superset can be tricked into approving changes or granting access without the user’s consent. An attacker who can lure a logged‑in user to a malicious site could cause these unwanted actions. Upgrade to the latest Superset release or apply the provided security patch to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
pip	apache software foundation	apache-superset	<= 1.5.2 2.0.0
–	apache	superset	<= 1.5.2 2.0.0 `cpe:2.3:a:apache:superset::::::::`

Original advisory text

Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API

Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

References

https://github.com/advisories/GHSA-7222-r37x-8q3m
https://lists.apache.org/thread/xc309h2dphrkg33154djf3nqlh2xc1c0 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-43719 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43719... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published16 Jan 2023

Updated3 Nov 2026

First seen6 Mar 2026

Sources

GHSA-7222-r37x-8q3m · GHSA

CVE-2022-43719 · NVD

CVE-2022-43719 · OSV

Track software like this

Free during beta