From d71ed6ecf242517f06d3361875ba193b9af4e404 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 20 Sep 2024 19:51:41 +0000 Subject: [PATCH] Publish Advisories GHSA-fg5m-m723-7mv6 GHSA-fg5m-m723-7mv6 --- .../GHSA-fg5m-m723-7mv6.json | 81 +++++++++++++++++++ .../GHSA-fg5m-m723-7mv6.json | 54 ------------- 2 files changed, 81 insertions(+), 54 deletions(-) create mode 100644 advisories/github-reviewed/2024/09/GHSA-fg5m-m723-7mv6/GHSA-fg5m-m723-7mv6.json delete mode 100644 advisories/unreviewed/2024/09/GHSA-fg5m-m723-7mv6/GHSA-fg5m-m723-7mv6.json diff --git a/advisories/github-reviewed/2024/09/GHSA-fg5m-m723-7mv6/GHSA-fg5m-m723-7mv6.json b/advisories/github-reviewed/2024/09/GHSA-fg5m-m723-7mv6/GHSA-fg5m-m723-7mv6.json new file mode 100644 index 00000000000..1130d4c62a4 --- /dev/null +++ b/advisories/github-reviewed/2024/09/GHSA-fg5m-m723-7mv6/GHSA-fg5m-m723-7mv6.json @@ -0,0 +1,81 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fg5m-m723-7mv6", + "modified": "2024-09-20T19:50:07Z", + "published": "2024-09-16T14:37:27Z", + "aliases": [ + "CVE-2024-8862" + ], + "summary": "D-Tale Command Execution Vulnerability", + "details": "D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\\views.py, under the route @dtale.route(\"/chart-data/\"), the query parameters from the request are directly passed into run_query for execution. And the run_query function calls proceed without performing any processing or sanitization of the query parameter. As a result, the query is directly used in the df.query method for data retrieval. Tthe engine used is `python`, which allows executing the query expression ans leading to a command execution vulnerability. ", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "dtale" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.14.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8862" + }, + { + "type": "WEB", + "url": "https://github.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8" + }, + { + "type": "PACKAGE", + "url": "https://github.com/man-group/dtale" + }, + { + "type": "WEB", + "url": "https://rumbling-slice-eb0.notion.site/Unauthenticated-Remote-Command-Execution-via-Panda-df-query-9dc40f0477ee4b65806de7921876c222?pvs=4" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.277499" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.277499" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.403200" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-09-20T19:50:07Z", + "nvd_published_at": "2024-09-14T20:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-fg5m-m723-7mv6/GHSA-fg5m-m723-7mv6.json b/advisories/unreviewed/2024/09/GHSA-fg5m-m723-7mv6/GHSA-fg5m-m723-7mv6.json deleted file mode 100644 index 4d43d4a5d4f..00000000000 --- a/advisories/unreviewed/2024/09/GHSA-fg5m-m723-7mv6/GHSA-fg5m-m723-7mv6.json +++ /dev/null @@ -1,54 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fg5m-m723-7mv6", - "modified": "2024-09-16T14:37:27Z", - "published": "2024-09-16T14:37:27Z", - "aliases": [ - "CVE-2024-8862" - ], - "details": "A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the argument query leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" - }, - { - "type": "CVSS_V4", - "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8862" - }, - { - "type": "WEB", - "url": "https://rumbling-slice-eb0.notion.site/Unauthenticated-Remote-Command-Execution-via-Panda-df-query-9dc40f0477ee4b65806de7921876c222?pvs=4" - }, - { - "type": "WEB", - "url": "https://vuldb.com/?ctiid.277499" - }, - { - "type": "WEB", - "url": "https://vuldb.com/?id.277499" - }, - { - "type": "WEB", - "url": "https://vuldb.com/?submit.403200" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-502" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-09-14T20:15:11Z" - } -} \ No newline at end of file