Cross site request forgery (csrf)

2023-03-0101:15:00

PRIOn knowledge base

www.prio-n.com

dataiku

csrf

vulnerability

unauthorized

download

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.6%

JSON

In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download request.

CPENameOperatorVersion
data_science_studiolt11.3.2

CPE	Name	Operator	Version
	data_science_studio	lt	11.3.2

References

dataiku.com

gist.github.com/alert3/04e2d0a934001180104f846cfa00552b