Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API
Priority MEDIUM 41CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-352.
Summary
Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00587 48th percentileScored 2026-11-07
Fix Fixed Apache Superset (Apache Software Foundation): 2.0.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Superset | 2.0.0 to before 2.0.1; up to 1.5.2 | 2.0.1 | Patch available | CNA |
| — | apache-superset (PyPI) | up to 1.5.2 | — | No fix listed | GHSA-7222-r37x-8q3m |
| — | apache-superset (PyPI) | — | — | No fix listed | GHSA-7222-r37x-8q3m |
- Apache Superset VendorApache Affected 2.0.0 to before 2.0.1; up to 1.5.2 Fixed in 2.0.1 Patch available CNA
- apache-superset (PyPI) Vendor— Affected up to 1.5.2 Fixed in — No fix listed GHSA-7222-r37x-8q3m
- apache-superset (PyPI) Vendor— Affected — Fixed in — No fix listed GHSA-7222-r37x-8q3m
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:* | up to 1.5.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:superset:2.0.0:-:*:*:*:*:*:* | 2.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:superset:2.0.0:rc1:*:*:*:*:*:* | 2.0.0 rc1 | Vulnerable | Apache |
| cpe:2.3:a:apache:superset:2.0.0:rc2:*:*:*:*:*:* | 2.0.0 rc2 | Vulnerable | Apache |
- cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:* Versions up to 1.5.2 Vulnerable ·Apache
- cpe:2.3:a:apache:superset:2.0.0:-:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:superset:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·Apache
- cpe:2.3:a:apache:superset:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·Apache
Remediation
- Fix · CNA Apache Superset (Apache Software Foundation) Fixed in 2.0.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Apache Superset 2.0.1
7 records Highest priority Priority MEDIUM 1 MEDIUM, 6 LOW
Other records, highest priority first
- TI-2022-22404 Apache Superset: Dashboard metadata information leakPriority LOW 27
- TI-2022-21475 Apache Superset: Improper rendering of user inputPriority LOW 27
- TI-2022-21473 Apache Superset: Cross-Site Scripting vulnerability on upload formsPriority LOW 27
Timeline
- 2026-10-02 Threatist record created from CVE-2022-43719
- 2026-10-03 Alias added: GHSA-7222-r37x-8q3m
References
More Apache Superset vulnerabilities
- TI-2023-12249 Apache Superset: Session validation vulnerability when using provided default SECRET_KEY KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05798 Deserialization of untrusted data in Superset CVSS 3.0CRITICAL 9.8
- TI-2023-21408 Apache Superset: Privilege escalation with default examples database CVSS 3.1HIGH 8.8
- TI-2023-20410 Apache Superset: Possible Unauthorized Registration of SQLite Database Connections CVSS 3.1MEDIUM 6.5
- TI-2021-09242 Apache Superset stored XSS on Dashboard markdown CVSS 3.1MEDIUM 5.4
- TI-2021-09359 Apache Superset Open Redirect CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-43719 · CVE Program
- CVE-2022-43719 · NVD
- FIRST EPSS
- GHSA-7222-r37x-8q3m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences