{"id":"CVE-2021-28125","aliases":["BIT-superset-2021-28125","EUVD-2021-0020","GHSA-pfwg-rxf4-97c3","PYSEC-2021-128","PYSEC-2026-3078"],"status":"published","title":"Apache Superset Open Redirect","description":"Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.64016,"percentile":0.99236,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2021-04-27T09:27:22Z","modified":"2026-10-24T10:30:19Z","fixes":[{"ecosystem":"PyPI","package":"apache-superset","fixed_in":["1.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"superset","fixed_in":["1.0.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.34.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"apache-superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"superset","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.34.0"}]}],"versions":["0.13.2","0.14.0","0.14.1","0.15.0","0.15.1","0.15.3","0.15.4","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.18.0","0.18.2","0.18.3","0.18.4","0.18.5","0.19.0","0.19.1","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.20.5","0.20.6","0.21.0","0.21.1","0.22.0","0.22.1","0.23.0","0.23.1","0.23.2","0.23.3","0.24.0","0.25.0","0.25.1","0.25.2","0.25.3","0.25.4","0.25.5","0.25.6","0.26.0","0.26.2","0.26.3","0.27.0","0.27.0rc1","0.28.0","0.28.1","0.29.0rc6","0.29.0rc7","0.30.0","0.30.1"]},{"source":"osv","ecosystem":"PyPI","package":"apache-superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}],"versions":["0.34.0","0.34.1","0.35.1","0.35.2","0.36.0","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","1.0.0","1.0.1"]},{"source":"osv","ecosystem":"PyPI","package":"apache-superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}],"versions":["0.34.0","0.34.1","0.35.1","0.35.2","0.36.0","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","1.0.0","1.0.1"]},{"source":"osv","ecosystem":"PyPI","package":"superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.34.0"}]}],"versions":["0.13.2","0.14.0","0.14.1","0.15.0","0.15.1","0.15.3","0.15.4","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.18.0","0.18.2","0.18.3","0.18.4","0.18.5","0.19.0","0.19.1","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.20.5","0.20.6","0.21.0","0.21.1","0.22.0","0.22.1","0.23.0","0.23.1","0.23.2","0.23.3","0.24.0","0.25.0","0.25.1","0.25.2","0.25.3","0.25.4","0.25.5","0.25.6","0.26.0","0.26.2","0.26.3","0.27.0","0.27.0rc1","0.28.0","0.28.1","0.29.0rc6","0.29.0rc7","0.30.0","0.30.1"]}],"products":[{"vendor":"apache","product":"superset"},{"vendor":"apache software foundation","product":"apache superset"}],"references":[{"url":"https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E","tags":["x_refsource_MISC","mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2021/04/27/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28125","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434@%3Cdev.superset.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/superset/commit/eb35b804acf4d84cb70d02743e04b8afebbee029","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pfwg-rxf4-97c3","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-128.yaml","tags":["web"]},{"url":"https://github.com/apache/superset","tags":["package"]},{"url":"https://pypi.org/project/superset","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-28125","title":"Apache Superset Open Redirect","description":"Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.","status":"published","published":"2021-04-27T09:27:22Z","modified":"2024-08-03T21:33:17.571Z","cwes":["CWE-601"],"updated_at":"2026-11-02T14:33:09.175141Z"}],"euvd":[{"id":"EUVD-2021-0020","description":"Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.","status":"published","published":"2021-04-27T09:27:22Z","modified":"2024-08-03T21:33:17Z","updated_at":"2026-11-03T03:24:47.80549Z"}],"ghsa":[{"id":"GHSA-pfwg-rxf4-97c3","title":"Open Redirect in Apache Superset","description":"Apache Superset prior to 1.1.0 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.","status":"published","published":"2021-10-06T17:47:53Z","modified":"2023-01-27T05:07:54Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:36:22.592333Z"}],"nvd":[{"id":"CVE-2021-28125","description":"Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.","status":"published","published":"2021-04-27T10:15:09.693Z","modified":"2026-06-17T03:45:50.487Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:06:52.81233Z"}],"osv":[{"id":"CVE-2021-28125","description":"Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.","status":"published","published":"2021-04-27T10:15:09.693Z","modified":"2026-10-24T10:30:19.658185906Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"GHSA-pfwg-rxf4-97c3","title":"Open Redirect in Apache Superset","description":"Apache Superset prior to 1.1.0 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.","status":"published","published":"2021-10-06T17:47:53Z","modified":"2026-07-13T16:43:32.420251064Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"PYSEC-2026-3078","title":"Open Redirect in Apache Superset","description":"Apache Superset prior to 1.1.0 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.","status":"published","published":"2026-07-09T16:49:33.778413Z","modified":"2026-07-13T16:43:32.420251064Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.429374Z"},{"id":"BIT-superset-2021-28125","title":"Apache Superset Open Redirect","description":"Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.","status":"published","published":"2025-02-05T07:29:54.416Z","modified":"2026-09-08T08:48:19.582619923Z","updated_at":"2026-11-02T15:28:35.51001Z"},{"id":"PYSEC-2021-128","description":"Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.","status":"published","published":"2021-04-27T10:15:00Z","modified":"2026-07-13T16:43:32.420251064Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}