PT-2023-19376 · Dataiku · Dataiku Dss

Alert3 + 1 · Publicado 2023-03-01 · Atualizado 2025-03-10 · CVE-2023-24045

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dataiku DSS version 11.2.1

Description The issue allows an attacker to download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download request.

Recommendations For Dataiku DSS version 11.2.1, consider restricting access to the myfiles section to prevent unauthorized file downloads until a patch is available.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-24045

Produtos afetados

Dataiku Dss

Referências · 6

• 🔥 https://gist.github.com/alert3/04e2d0a934001180104f846cfa00552b · Exploit
• https://osv.dev/vulnerability/CVE-2023-24045 · Aviso do Fabricante
• https://dataiku.com · Nota
• https://t.me/cvenotify/114116 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-24045 · Nota de Segurança
• https://t.me/cibsecurity/59193 · Publicação no Telegram