CVE-2024-21642CWE-918

D-Tale server-side request forgery through Web uploads

High · published January 5, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the `Load From the Web` input is turned off by default. The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00711 · 53.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-01-05T21:11Z
EPSS history
Timeline
  • 05 JAN 21:11Z
    D-Tale server-side request forgery through Web uploads
    cvelistv5