CVE-2024-29890

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Mar 29, 2024
Updated: Apr 1, 2024
CWE ID 79

Summary

CVE-2024-29890 is a high-severity vulnerability affecting DataLens, a business intelligence and data visualization system. An attacker could exploit this vulnerability by crafting a specific request that allows them to create a chart with custom JavaScript code. This code would then be executed in an unprotected sandbox on subsequent requests to that chart. The issue was addressed in the datalens-ui version 0.1449.0. To mitigate the risk, access to the API for creating or modifying charts should be restricted (/charts/api/charts/v1/). The vulnerability has a base severity score of 8.8 out of 10 and poses a high potential danger to organizations as it could lead to unauthorized execution of malicious code and compromise the confidentiality and integrity of data.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-29890 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options