CVE-2021-27907

Description

Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.

How to fix CVE-2021-27907

To remediate CVE-2021-27907, upgrade the affected package to a fixed version below.

• —upgrade to 0.38.1 or later
• —upgrade to 0.38.1 or later
• —upgrade to 0.38.1 or later

Is CVE-2021-27907 being exploited?

Low — EPSS is 2.5%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 0.38.1
• from 0, < 0.38.1
• from 0, < 0.38.1

CVSS scores

References (6)

• ADVISORYgithub.com/advisories/GHSA-w358-rj93-r5qv
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-27907
• PATCHgithub.com/apache/superset
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-127.yaml