Credentials disclosure through path traversal
Information
-
Advisory ID: DSA-2022-016
-
CVSS String: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
-
CVSS Base Score: 8.8 (High)
-
CWE classification: CWE-23
Summary
It was discovered that a path traversal issue could lead to the disclosure of sensitive information in the Dataiku configuration folder, including credentials.
Affected Products
-
Dataiku DSS 9 and older versions
-
Dataiku DSS 10 before 10.0.9
-
Dataiku DSS 11 before 11.0.3
Fix
Dataiku DSS 10.0.9 and Dataiku DSS 11.0.3 have been made available to customers to remediate this issue