{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-6586", "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484", "state": "PUBLISHED", "assignerShortName": "Mandiant", "dateReserved": "2024-07-08T21:24:57.730Z", "datePublished": "2024-08-30T22:25:48.431Z", "dateUpdated": "2024-09-03T14:50:25.611Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Lightdash", "vendor": "Lightdash", "versions": [{"changes": [{"at": "0.1027.2", "status": "unaffected"}], "lessThan": "0.1027.2", "status": "affected", "version": "0.1024.6", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Kenneth Chiong, Mandiant"}, {"lang": "en", "type": "reporter", "value": "Kenneth Chiong, Mandiant"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover."}], "value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484", "shortName": "Mandiant", "dateUpdated": "2024-08-30T22:25:48.431Z"}, "references": [{"url": "https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2024-6586"}, {"url": "https://github.com/lightdash/lightdash"}, {"url": "https://github.com/lightdash/lightdash/releases/tag/0.1027.2"}, {"url": "https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9295.patch"}, {"url": "https://github.com/lightdash/lightdash/pull/9295"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "lightdash", "product": "lightdash", "cpes": ["cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0.1024.6", "status": "affected", "lessThan": "0.1027.2", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-09-03T14:48:51.247263Z", "id": "CVE-2024-6586", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T14:50:25.611Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-6586", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-03T14:48:51.247263Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*"], "vendor": "lightdash", "product": "lightdash", "versions": [{"status": "affected", "version": "0.1024.6", "lessThan": "0.1027.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T14:50:16.434Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Kenneth Chiong, Mandiant"}, {"lang": "en", "type": "reporter", "value": "Kenneth Chiong, Mandiant"}], "affected": [{"vendor": "Lightdash", "product": "Lightdash", "versions": [{"status": "affected", "changes": [{"at": "0.1027.2", "status": "unaffected"}], "version": "0.1024.6", "lessThan": "0.1027.2", "versionType": "custom"}], "defaultStatus": "affected"}], "references": [{"url": "https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2024-6586"}, {"url": "https://github.com/lightdash/lightdash"}, {"url": "https://github.com/lightdash/lightdash/releases/tag/0.1027.2"}, {"url": "https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9295.patch"}, {"url": "https://github.com/lightdash/lightdash/pull/9295"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.", "supportingMedia": [{"type": "text/html", "value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484", "shortName": "Mandiant", "dateUpdated": "2024-08-30T22:25:48.431Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6586", "state": "PUBLISHED", "dateUpdated": "2024-09-03T14:50:25.611Z", "dateReserved": "2024-07-08T21:24:57.730Z", "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484", "datePublished": "2024-08-30T22:25:48.431Z", "assignerShortName": "Mandiant"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover."}, {"lang": "es", "value": "La versi\u00f3n 0.1024.6 de Lightdash permite a los usuarios con los permisos necesarios, como Administrador o Editor, crear y compartir paneles. Un panel que contiene elementos HTML que apuntan a una fuente controlada por un actor de amenazas puede activar una solicitud SSRF cuando se exporta, a trav\u00e9s de una solicitud POST a /api/v1/dashboards//export. La solicitud falsificada contiene el valor del token de sesi\u00f3n del usuario exportador. Un actor de amenazas podr\u00eda obtener el token de sesi\u00f3n de cualquier usuario que exporte el panel. El token de sesi\u00f3n obtenido se puede utilizar para realizar acciones como v\u00edctima en la aplicaci\u00f3n, lo que da como resultado la toma de control de la sesi\u00f3n."}], "id": "CVE-2024-6586", "lastModified": "2024-09-03T15:35:16.577", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-08-30T23:15:12.747", "references": [{"source": "mandiant-cve@google.com", "url": "https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf"}, {"source": "mandiant-cve@google.com", "url": "https://github.com/lightdash/lightdash"}, {"source": "mandiant-cve@google.com", "url": "https://github.com/lightdash/lightdash/pull/9295"}, {"source": "mandiant-cve@google.com", "url": "https://github.com/lightdash/lightdash/releases/tag/0.1027.2"}, {"source": "mandiant-cve@google.com", "url": "https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9295.patch"}, {"source": "mandiant-cve@google.com", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6586"}], "sourceIdentifier": "mandiant-cve@google.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}], "source": "mandiant-cve@google.com", "type": "Secondary"}]}

{}