VDB
CVE-2025-55672
CVE-2025-55672
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.
EPSS 0.74% · 54.4th percentile
Risk Scores
CVSS 4.0
5.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score
0.74%
54.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | superset | 0 |
| Bitnami | superset | 0 |
Timeline
- Aug 14, 2025 CVE Published
- Aug 14, 2025 PoC Published
- Aug 14, 2025 PoC Published
- Aug 15, 2025 EPSS Score
- Aug 24, 2025 EPSS Score
- Sep 2, 2025 EPSS Score
- Sep 12, 2025 EPSS Score
- Sep 21, 2025 EPSS Score
- Sep 30, 2025 EPSS Score
- Oct 9, 2025 EPSS Score
- Oct 18, 2025 EPSS Score
- Oct 27, 2025 EPSS Score