CVE-2024-21485

🗓️ 02 Feb 2024 05:00:01Reported by snykType

Versions of the package dash-core-components before 2.13.0; all versions of the package dash-core-components; versions of the package dash before 2.15.0; all versions of the package dash-html-components; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view - not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server

Reporter	Title	Published	Views	Family All 28
AlpineLinux	CVE-2024-21485	2 Feb 202405:15	–	alpinelinux
Circl	CVE-2024-21485	2 Feb 202406:31	–	circl
CNNVD	Dash Cross-Site Scripting Vulnerability	2 Feb 202400:00	–	cnnvd
Cvelist	CVE-2024-21485	2 Feb 202405:00	–	cvelist
EUVD	EUVD-2024-0032	3 Oct 202520:07	–	euvd
Github Security Blog	Dash apps vulnerable to Cross-site Scripting	2 Feb 202406:30	–	github
Nuclei	Dash Framework - Cross-site Scripting	7 Jun 202603:02	–	nuclei
NVD	CVE-2024-21485	2 Feb 202405:15	–	nvd
OSV	GHSA-547X-748V-VP6P Dash apps vulnerable to Cross-site Scripting	2 Feb 202406:30	–	osv
OSV	PYSEC-2024-35	2 Feb 202405:15	–	osv

NVD

Node

plotly dashRange<2.13.0

plotly dashRange2.14.0–2.15.0

[
  {
    "product": "dash-core-components",
    "versions": [
      {
        "version": "0",
        "lessThan": "2.13.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "dash-core-components",
    "versions": [
      {
        "version": "0",
        "lessThan": "2.0.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "dash",
    "versions": [
      {
        "version": "0",
        "lessThan": "2.15.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "dash-html-components",
    "versions": [
      {
        "version": "0",
        "lessThan": "2.0.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  },
  {
    "product": "dash-html-components",
    "versions": [
      {
        "version": "0",
        "lessThan": "2.0.16",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
github	www.github.com/plotly/dash/releases/tag/v2.15.0
security	www.security.snyk.io/vuln/SNYK-PYTHON-DASHHTMLCOMPONENTS-6226336
security	www.security.snyk.io/vuln/SNYK-PYTHON-DASHCORECOMPONENTS-6226334
security	www.security.snyk.io/vuln/SNYK-JS-DASHCORECOMPONENTS-6183084
security	www.security.snyk.io/vuln/SNYK-PYTHON-DASH-6226335
github	www.github.com/plotly/dash/pull/2732
github	www.github.com/plotly/dash/commit/9920073c9a8619ae8f90fcec1924f2f3a4332a8c
github	www.github.com/plotly/dash/issues/2729
security	www.security.snyk.io/vuln/SNYK-JS-DASHHTMLCOMPONENTS-6226337

15 May 2025 20:15Current

5Medium risk

Vulners AI Score5

CVSS 3.15.4 - 6.5

EPSS0.01232

SSVC

CWE-79