CVE-2023-24045

In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download request.

Score

CVSS 3.1 6.5 Medium

Status

Modified - cve@mitre.org

Published

2023-03-01

Last modified

2025-03-10

Weaknesses

CWE-434

Affected products

• Data Science Studio (Dataiku)

References

• https://dataiku.com
• https://gist.github.com/alert3/04e2d0a934001180104f846cfa00552b