En resumen
- CVE-2024-55890 es una vulnerabilidad MEDIO (CVSS 6.9) que afecta a dtale.
- Probabilidad de explotación en los próximos 30 días (EPSS): 2.4%, mayor que el 84.2% de las vulnerabilidades.
- Solución: actualizar a 3.16.1 o posterior.
| Package | Affected versions | Patched versions |
|---|
| dtale PyPI | < 3.16.1
| 3.16.1
|
Description
Impact
Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.
Patches
Users should upgrade to version 3.16.1 where the update-settings endpoint blocks the ability for users to update the enable_custom_filters flag. You can find out more information on how to turn that flag on here
Workarounds
The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.
References
See "Custom Filter" documentation
NVD description
D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the `update-settings` endpoint blocks the ability for users to update the `enable_custom_filters` flag. The only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free