Lucene search

GitHub_MCVE-2024-45595

HistorySep 10, 2024 - 4:15 p.m.

CVE-2024-45595

2024-09-1016:15:21

CWE-79

GitHub_M

web.nvd.nist.gov

d-tale

pandas

data structure

vulnerability

remote code execution

malicious code

upgrade

version 3.14.1

custom filter

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

Low

EPSS

0.001

Percentile

30.7%

JSON

D-Tale is a visualizer for Pandas data structures. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.14.1 where the “Custom Filter” input is turned off by default.

Affected configurations

Nvd

Vulners

Node

mand-taleRange<3.14.1

VendorProductVersionCPE
mand-tale*cpe:2.3:a:man:d-tale:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
man	d-tale	*	cpe:2.3:a:man:d-tale::::::::

CNA Affected

[
  {
    "vendor": "man-group",
    "product": "dtale",
    "versions": [
      {
        "version": "<  3.14.1",
        "status": "affected"
      }
    ]
  }
]

References

github.com/man-group/dtale#custom-filter

github.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8

github.com/man-group/dtale/security/advisories/GHSA-pw44-4h99-wqff

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

Low

EPSS

0.001

Percentile

30.7%

JSON

Related for CVE-2024-45595