Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS03aGZ4LWgzajMtcndxNM4AA4N6

D-Tale server-side request forgery through Web uploads

Impact

Users hosting D-Tale publicly can be vulnerable to server-side request forgery (SSRF) allowing attackers to access files on the server.

Patches

Users should upgrade to version 3.9.0 where the "Load From the Web" input is turned off by default. You can find out more information on how to turn it back on here

Workarounds

The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.

References

See "Load Data & Sample Datasets" documentation

Permalink: https://github.com/advisories/GHSA-7hfx-h3j3-rwq4
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03aGZ4LWgzajMtcndxNM4AA4N6
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 4 months ago
Updated: 4 months ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-7hfx-h3j3-rwq4, CVE-2024-21642
References: Repository: https://github.com/man-group/dtale
Blast Radius: 14.5

Affected Packages

pypi:dtale
Dependent packages: 13
Dependent repositories: 87
Downloads: 49,111 last month
Affected Version Ranges: < 3.9.0
Fixed in: 3.9.0
All affected versions: 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.4.0, 1.4.1, 1.5.0, 1.5.1, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.6.10, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 1.7.9, 1.7.10, 1.7.11, 1.7.12, 1.7.13, 1.7.14, 1.7.15, 1.8.0, 1.8.1, 1.8.3, 1.8.4, 1.8.6, 1.8.7, 1.8.8, 1.8.9, 1.8.10, 1.8.11, 1.8.12, 1.8.13, 1.8.14, 1.8.15, 1.8.16, 1.8.17, 1.8.18, 1.8.19, 1.9.0, 1.9.1, 1.9.2, 1.10.0, 1.11.0, 1.12.0, 1.12.1, 1.13.0, 1.14.0, 1.14.1, 1.15.2, 1.16.0, 1.17.0, 1.18.0, 1.18.1, 1.18.2, 1.19.0, 1.19.1, 1.19.2, 1.20.0, 1.21.0, 1.21.1, 1.22.0, 1.22.1, 1.23.0, 1.24.0, 1.25.0, 1.26.0, 1.27.0, 1.28.0, 1.28.1, 1.29.0, 1.29.1, 1.30.0, 1.31.0, 1.32.0, 1.32.1, 1.33.0, 1.33.1, 1.34.0, 1.35.0, 1.36.0, 1.37.0, 1.37.1, 1.38.0, 1.39.0, 1.40.0, 1.40.1, 1.40.2, 1.41.0, 1.41.1, 1.42.0, 1.42.1, 1.43.0, 1.44.0, 1.44.1, 1.45.0, 1.46.0, 1.47.0, 1.48.0, 1.49.0, 1.50.0, 1.50.1, 1.51.0, 1.52.0, 1.53.0, 1.54.0, 1.54.1, 1.55.0, 1.56.0, 1.57.0, 1.58.1, 1.58.2, 1.58.3, 1.59.0, 1.59.1, 1.60.1, 1.60.2, 1.61.0, 1.61.1, 2.0.0, 2.1.0, 2.1.2, 2.2.0, 2.3.0, 2.4.0, 2.5.1, 2.6.0, 2.7.1, 2.8.0, 2.8.1, 2.9.0, 2.9.1, 2.10.0, 2.11.0, 2.12.0, 2.12.1, 2.12.2, 2.12.3, 2.13.0, 2.14.0, 2.14.1, 2.15.0, 2.15.2, 2.16.0, 3.0.0, 3.1.0, 3.1.6, 3.1.7, 3.2.0, 3.3.0, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.1
All unaffected versions: 3.9.0, 3.10.0, 3.11.0, 3.12.0