PT-2024-27279 · Unknown · Ydata-Profiling

Published 2024-06-04 · Updated 2024-06-04 · CVE-2024-37063

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ydata-profiling versions 3.7.0 or newer

Description A cross-site scripting (XSS) issue in the ydata-profiling open-source library allows malicious payloads to run when a maliciously crafted report is viewed in the browser.

Recommendations For versions 3.7.0 or newer, consider disabling the report viewing feature in the browser until a patch is available to prevent potential XSS attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-37063

GHSA-2R57-2MRH-GGJV

Affected Products

Ydata-Profiling

References · 5

• https://osv.dev/vulnerability/GHSA-2r57-2mrh-ggjv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37063 · Security Note
• https://github.com/ydataai/ydata-profiling · Note
• https://hiddenlayer.com/sai-security-advisory/ydata-june2024 · Note
• https://t.me/cvenotify/81913 · Telegram Post