CVE-2024-21642
published 2024-01-05CVE-2024-21642: D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.71%
48.9th percentile
D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the `Load From the Web` input is turned off by default. The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| man-group | dtale | < 3.9.0 | 3.9.0 |
| man-group | dtale | >= 0 < 3.9.0 | 3.9.0 |
| man | d-tale | < 3.9.0 | 3.9.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
D-Tale server-side request forgery through Web uploads
ghsa·2024-01-05
CVE-2024-21642 [HIGH] CWE-918 D-Tale server-side request forgery through Web uploads
D-Tale server-side request forgery through Web uploads
### Impact
Users hosting D-Tale publicly can be vulnerable to server-side request forgery (SSRF) allowing attackers to access files on the server.
### Patches
Users should upgrade to version 3.9.0 where the "Load From the Web" input is turned off by default. You can find out more information on how to turn it back on [here](https://github.com/man-group/dtale?tab=readme-ov-file#load-data--sample-datasets)
### Workarounds
The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.
### References
See "Load Data & Sample Datasets" [documentation](https://github.com/man-group/dtale?tab=readme-ov-file#load-data--sample-datasets)
OSV
D-Tale server-side request forgery through Web uploads
osv·2024-01-05
CVE-2024-21642 [HIGH] D-Tale server-side request forgery through Web uploads
D-Tale server-side request forgery through Web uploads
### Impact
Users hosting D-Tale publicly can be vulnerable to server-side request forgery (SSRF) allowing attackers to access files on the server.
### Patches
Users should upgrade to version 3.9.0 where the "Load From the Web" input is turned off by default. You can find out more information on how to turn it back on [here](https://github.com/man-group/dtale?tab=readme-ov-file#load-data--sample-datasets)
### Workarounds
The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.
### References
See "Load Data & Sample Datasets" [documentation](https://github.com/man-group/dtale?tab=readme-ov-file#load-data--sample-datasets)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/man-group/dtale/commit/954f6be1a06ff8629ead2c85c6e3f8e2196b3df2https://github.com/man-group/dtale/security/advisories/GHSA-7hfx-h3j3-rwq4https://github.com/man-group/dtale?tab=readme-ov-file#load-data--sample-datasetshttps://github.com/man-group/dtale/commit/954f6be1a06ff8629ead2c85c6e3f8e2196b3df2https://github.com/man-group/dtale/security/advisories/GHSA-7hfx-h3j3-rwq4https://github.com/man-group/dtale?tab=readme-ov-file#load-data--sample-datasets
2024-01-05
Published