« Volver al listado

CVE-2024-6586

Estado: AplazadaAlta (7.3)—💥 Exploit

Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user’s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Lightdash — LightdashAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-6586",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6586",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-03T14:48:51.247263Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "mandiant-cve@google.com",
      "affectedData": [
        {
          "vendor": "Lightdash",
          "product": "Lightdash",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "0.1027.2",
                  "status": "unaffected"
                }
              ],
              "version": "0.1024.6",
              "lessThan": "0.1027.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*"
          ],
          "vendor": "lightdash",
          "product": "lightdash",
          "versions": [
            {
              "status": "affected",
              "version": "0.1024.6",
              "lessThan": "0.1027.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-30T23:15:12.747",
  "references": [
    {
      "url": "https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf",
      "source": "mandiant-cve@google.com"
    },
    {
      "url": "https://github.com/lightdash/lightdash",
      "source": "mandiant-cve@google.com"
    },
    {
      "url": "https://github.com/lightdash/lightdash/pull/9295",
      "source": "mandiant-cve@google.com"
    },
    {
      "url": "https://github.com/lightdash/lightdash/releases/tag/0.1027.2",
      "source": "mandiant-cve@google.com"
    },
    {
      "url": "https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9295.patch",
      "source": "mandiant-cve@google.com"
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6586",
      "source": "mandiant-cve@google.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mandiant-cve@google.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user’s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover."
    },
    {
      "lang": "es",
      "value": "La versión 0.1024.6 de Lightdash permite a los usuarios con los permisos necesarios, como Administrador o Editor, crear y compartir paneles. Un panel que contiene elementos HTML que apuntan a una fuente controlada por un actor de amenazas puede activar una solicitud SSRF cuando se exporta, a través de una solicitud POST a /api/v1/dashboards//export. La solicitud falsificada contiene el valor del token de sesión del usuario exportador. Un actor de amenazas podría obtener el token de sesión de cualquier usuario que exporte el panel. El token de sesión obtenido se puede utilizar para realizar acciones como víctima en la aplicación, lo que da como resultado la toma de control de la sesión."
    }
  ],
  "lastModified": "2026-06-17T08:18:17.640",
  "sourceIdentifier": "mandiant-cve@google.com"
}