Insufficient permission checks in code envs API¶
Information¶
Advisory ID: DSA-2024-005
CVSS Base Score: 6.5
CVSS String: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity: Medium
CWE classification: CWE-284
Advisory Release Date: July 8th, 2024
Summary¶
Until DSS 12.6.5, some code env API calls did not perform enough permission checks, which could allow authenticated-but-not-permissioned users to act on code envs through the API.
Affected Products¶
Dataiku DSS before 12.6.5, and 13.0.0
Fix¶
Dataiku DSS 12.6.5 and 13.0.1 have been made available to customers to remediate this issue.