PT-2024-23113 · Datalens · Datalens

Highresure · Published 2024-03-29 · Updated 2024-04-01 · CVE-2024-29890

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataLens versions prior to 0.1449.0

Description A specifically crafted request allowed the creation of a special chart type with the ability to pass custom javascript code that would later be executed in an unprotected sandbox on subsequent requests to that chart.

Recommendations For versions prior to 0.1449.0, update to version 0.1449.0 to resolve the issue. As a temporary workaround, consider restricting access to the API for creating or modifying charts ("/charts/api/charts/v1/") to mitigate the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-29890

GHSA-6278-2WVC-4P93

Affected Products

Datalens

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29890.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-29890 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29890 · Vendor Advisory
• https://github.com/datalens-tech/datalens/security/advisories/GHSA-6278-2wvc-4p93 · Note
• https://twitter.com/VulmonFeeds/status/1773754214180667903 · Twitter Post
• https://twitter.com/CVEnew/status/1773730744508019178 · Twitter Post