PT-2024-18904 · Unknown+1 · Dash-Core-Components+2

Gtsp233 · Published 2024-02-01 · Updated 2025-05-15 · CVE-2024-21485

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions dash-core-components versions prior to 2.13.0 dash versions prior to 2.15.0 dash-html-components versions prior to 2.0.16

Description The issue allows an authenticated attacker to steal data visible to another user who opens a view that exploits this vulnerability. The attacker could also make additional requests and access other data accessible to this user. In some cases, they could steal the access tokens of that user, allowing the attacker to act as that user, including viewing other apps and resources hosted on the same server. This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user.

Recommendations For dash-core-components versions prior to 2.13.0, update to version 2.13.0 or later. For dash versions prior to 2.15.0, update to version 2.15.0 or later. For dash-html-components versions prior to 2.0.16, update to version 2.0.16 or later. As a temporary workaround, consider restricting the use of the href attribute in the a tag to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-21485

GHSA-547X-748V-VP6P

PYSEC-2024-35

Affected Products

Dash

Dash-Core-Components

Dash-Html-Components

References · 22

• 🔥 https://github.com/plotly/dash/issues/2729 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-PYTHON-DASHCORECOMPONENTS-6226334 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-PYTHON-DASH-6226335 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-PYTHON-DASHHTMLCOMPONENTS-6226336 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-DASHCORECOMPONENTS-6183084 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-JS-DASHHTMLCOMPONENTS-6226337 · Exploit
• https://github.com/plotly/dash/pull/2732 · Patch
• https://github.com/plotly/dash/commit/9920073c9a8619ae8f90fcec1924f2f3a4332a8c · Patch
• https://osv.dev/vulnerability/GHSA-547x-748v-vp6p · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-35 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21485 · Security Note
• https://github.com/plotly/dash/releases/tag/v2.15.0 · Note
• https://github.com/plotly/dash · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/dash/PYSEC-2024-35.yaml · Note