PT-2023-19376 · Dataiku · Dataiku Dss

Alert3 + 1 · Published 2023-03-01 · Updated 2025-03-10 · CVE-2023-24045

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dataiku DSS version 11.2.1

Description The issue allows an attacker to download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download request.

Recommendations For Dataiku DSS version 11.2.1, consider restricting access to the myfiles section to prevent unauthorized file downloads until a patch is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-24045

Affected Products

Dataiku Dss

References · 6

• 🔥 https://gist.github.com/alert3/04e2d0a934001180104f846cfa00552b · Exploit
• https://osv.dev/vulnerability/CVE-2023-24045 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24045 · Security Note
• https://dataiku.com · Note
• https://t.me/cvenotify/114116 · Telegram Post
• https://t.me/cibsecurity/59193 · Telegram Post