QID 150783

Apache Superset is an open-source software application for data exploration and data visualization able to handle data at petabyte scale.

A stored cross-site scripting (XSS) vulnerability exists in Apache Superset. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS.

Affected Versions:
Apache Superset before 3.0.3

QID Detection Logic (Unauthenticated):
This QID sends a HTTP GET request and checks the response body to confirm if the host is running vulnerable version of Apache Superset.

Successful exploitation could allow an attacker to execute arbitrary JavaScript code in the context of the interface or allow the attacker to access sensitive, browser-based information.