by Kastro
Paper/Archive/CVE-2024-45595

CVE-2024-45595

man-group dtale — D-Tale allows Remote Code Execution through the Query input on Chart Builder

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 56.0.560 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

D-Tale is a visualizer for Pandas data structures. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.14.1 where the "Custom Filter" input is turned off by default.

Affected

ProductAffectedFixed inSource
dtale< 3.14.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/man-group/dtale/security/advisories/GHSA-pw44-4h99-wqffrefgithub.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8refgithub.com/man-group/dtale#custom-filter