What’s Vulnerable › Vulnerabilities

CVE-2023-24045

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-03-01 · updated 2026-06-17
• Weakness: CWE-434

Description

In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target username in a download request.

Affected products

• Dataiku Data Science Studio: before 11.3.2 — fixed in 11.3.2

How to fix

Upgrade to a fixed version: Dataiku Data Science Studio 11.3.2. Check the vendor advisory for mitigations.

References

• https://dataiku.com
• https://gist.github.com/alert3/04e2d0a934001180104f846cfa00552b
• https://dataiku.com
• https://gist.github.com/alert3/04e2d0a934001180104f846cfa00552b

Get alerted when CVE-2023-24045 or the next vulnerability affects your stack