CVE-2021-28125 json
Apache Superset Open Redirect
published 2021-04-27 5 y ago modified 2026-09-08 2 mo ago also BIT-superset-2021-28125 , EUVD-2021-0020 , GHSA-pfwg-rxf4-97c3 , PYSEC-2021-128 , PYSEC-2026-3078
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 64.0%
- EPSS 64.0% chance of exploitation in 30 days, percentile 99.2%
- public exploits
- 0
- none known
Summary
Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.
Patch / fix
Exploit prediction
64.02% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | superset | <=0.34.0 |
no fix listed |
| pypi | apache-superset | <1.1.0 |
1.1.0 |
| bitnami | superset | <1.0.2 |
1.0.2 |
Affected products
- Apache Software Foundation Apache Superset
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/apache/superset/commit/eb35b804acf4d84cb70d02743e04b8afebbee029
web
-
lists.apache.org
/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E
mailing-list, web, third-party-advisory, advisory
-
openwall.com
/lists/oss-security/2021/04/27/2
mailing-list, web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-28125
advisory, web
-
github.com
/advisories/GHSA-pfwg-rxf4-97c3
advisory
-
github.com
/apache/superset
package
-
github.com
/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-128.yaml
web
-
lists.apache.org
/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434@%3Cdev.superset.apache.org%3E
web
-
pypi.org
/project/superset
package
Sources
- CVE List CVE-2021-28125
- GitHub Advisory GHSA-pfwg-rxf4-97c3
- NVD CVE-2021-28125
- OSV BIT-superset-2021-28125
- OSV PYSEC-2021-128
- OSV PYSEC-2026-3078
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.