CVE-2021-42250: apache software foundation apache superset Improper Output Neutralization for Logs
CVSS: 6.5v3.1MediumModified
AliasesGHSA-5fp8-c45m-256pBIT-superset-2021-42250PYSEC-2021-435
Published 17-11-2021Last modified 04-08-2024
Vulnerability summary
CVE-2021-42250 is a medium (CVSS 6.5) Improper Output Neutralization for Logs vulnerability in apache software foundation apache superset. EPSS estimates a 1.82% chance of exploitation in the next 30 days, higher than 78.3% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
1.82%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 17-11-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.
CVSS metrics
4 scores · 2 sources · 3 versionsHigh 7.1Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NSourcesSingle source
Medium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NSourcesAll 2 agree
- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
1.82%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.82% on 18-09-2026
18-09-202618-10-2026
EPSS score1.82%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-117Improper Output Neutralization for LogsThe product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
- CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Affected systems
Apache1 product
- superset< 1.3.2
Apache software foundation1 product
- apache superset≥ Apache Superset, ≤ 1.3.1
PyPI1 product
- apache-superset< 1.3.2
3 vendors · 3 products
References
6 links- lists.apache.org/thread/53lkszw6d3tybp5t99nvgcj538b9trw9X Refsource MISCWEBMailing ListVendor Advisory
- www.openwall.com/lists/oss-security/2021/11/17/2Mailing ListX Refsource MLISTWEBThird Party Advisory
