PT-2021-17334 · Dataiku · Dataiku Dss

Xiejingwei Fei · Published 2021-03-01 · Updated 2021-03-05 · CVE-2021-27225

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Dataiku DSS versions prior to 8.0.6

Description: The issue is related to insufficient access control in the Jupyter notebooks integration, allowing users with coding permissions to read and overwrite notebooks in projects they are not authorized to access.

Recommendations: For versions prior to 8.0.6, update to version 8.0.6 or later to resolve the issue. As a temporary workaround, consider restricting coding permissions to authorized users or limiting access to sensitive projects until the update is applied.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-27225

Affected Products

Dataiku Dss

References · 7

• https://doc.dataiku.com/dss/latest · Vendor Advisory
• https://doc.dataiku.com/dss/8.0/security/advisories/cve-2021-27225.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27225 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27225 · Vendor Advisory
• https://t.me/cibsecurity/24285 · Telegram Post
• https://t.me/cvenotify/10649 · Telegram Post
• https://t.me/cvenotify/10957 · Telegram Post