{"id":"CVE-2024-21642","published":"2024-01-05T21:11:41Z","modified":"2025-06-17T20:29:14Z","title":"D-Tale server-side request forgery through Web uploads","vendor":"man-group","product":"dtale","tier":"tail","description":{"text":"D-Tale is a visualizer for Pandas data structures. Users hosting versions D-Tale prior to 3.9.0 publicly can be vulnerable to server-side request forgery (SSRF), allowing attackers to access files on the server. Users should upgrade to version 3.9.0, where the `Load From the Web` input is turned off by default. The only workaround for versions earlier than 3.9.0 is to only host D-Tale to trusted users.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00711,"percentile":0.53522,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://github.com/man-group/dtale/security/advisories/GHSA-7hfx-h3j3-rwq4","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/man-group/dtale/commit/954f6be1a06ff8629ead2c85c6e3f8e2196b3df2","tags":["x_refsource_MISC"]},{"url":"https://github.com/man-group/dtale?tab=readme-ov-file#load-data--sample-datasets","tags":["x_refsource_MISC"]}],"priority":{"score":16.0,"factors":[{"name":"EPSS percentile","points":10.7},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"man-group","affectedVersions":[{"vendor":"man-group","product":"dtale","versions":["< 3.9.0"]}],"affected":[{"ecosystem":"PyPI","package":"dtale","vulnerableRanges":["<3.9.0"],"patched":["3.9.0"],"from":["GHSA-7hfx-h3j3-rwq4","PYSEC-2026-1319"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-0283","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-man-group-dtale-cve-2023-46134","parents":[{"from":"CVE-2023-46134","to":"CVE-2024-21642","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:dtale","fromFixed":"3.7.0","toFixed":"3.9.0","daysApart":72},{"kind":"same-code","provenance":"machine","files":["dtale/__init__.py","dtale/app.py","dtale/config.py","dtale/global_state.py","dtale/templates/dtale/base.html"],"commits":["https://github.com/man-group/dtale/commit/bf8c54ab2490803f45f0652a9a0e221a94d39668","https://github.com/man-group/dtale/commit/954f6be1a06ff8629ead2c85c6e3f8e2196b3df2"],"basis":"shared function","functions":["AppSettings","base_render_template","build_show_options","load_app_settings","set_app_settings"]}]}],"children":[{"from":"CVE-2024-21642","to":"CVE-2024-55890","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["dtale/views.py"],"commits":["https://github.com/man-group/dtale/commit/954f6be1a06ff8629ead2c85c6e3f8e2196b3df2","https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a"],"basis":"shared function","functions":["update_settings"]}]}],"packageHistory":[{"cve":"CVE-2023-46134","published":"2023-10-25","fixed":"3.7.0","kev":false},{"cve":"CVE-2024-21642","published":"2024-01-05","fixed":"3.9.0","kev":false},{"cve":"CVE-2024-45595","published":"2024-09-10","fixed":"3.14.1","kev":false,"link":{"from":"CVE-2024-21642","to":"CVE-2024-45595","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:dtale","fromFixed":"3.9.0","toFixed":"3.14.1","daysApart":249},{"kind":"same-code","provenance":"machine","files":["dtale/views.py"],"commits":["https://github.com/man-group/dtale/commit/954f6be1a06ff8629ead2c85c6e3f8e2196b3df2","https://github.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8"],"basis":"shared file"}]}},{"cve":"CVE-2024-8862","published":"2024-09-14","fixed":"3.14.1","kev":false,"link":{"from":"CVE-2024-21642","to":"CVE-2024-8862","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:dtale","fromFixed":"3.9.0","toFixed":"3.14.1","daysApart":253},{"kind":"same-code","provenance":"machine","files":["dtale/views.py"],"commits":["https://github.com/man-group/dtale/commit/954f6be1a06ff8629ead2c85c6e3f8e2196b3df2","https://github.com/man-group/dtale/commit/b6e30969390520d1400b55acbb13e5487b8472e8"],"basis":"shared file"}]}},{"cve":"CVE-2024-55890","published":"2024-12-13","fixed":"3.16.1","kev":false}],"package":"PyPI:dtale"}}