« Back to list

CVE-2024-6586

Status: DeferredHigh (7.3)—💥 Exploit

Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user’s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

💥 Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Lightdash — LightdashAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2024-6586",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6586",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-03T14:48:51.247263Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "mandiant-cve@google.com",
      "affectedData": [
        {
          "vendor": "Lightdash",
          "product": "Lightdash",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "0.1027.2",
                  "status": "unaffected"
                }
              ],
              "version": "0.1024.6",
              "lessThan": "0.1027.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*"
          ],
          "vendor": "lightdash",
          "product": "lightdash",
          "versions": [
            {
              "status": "affected",
              "version": "0.1024.6",
              "lessThan": "0.1027.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-30T23:15:12.747",
  "references": [
    {
      "url": "https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf",
      "source": "mandiant-cve@google.com"
    },
    {
      "url": "https://github.com/lightdash/lightdash",
      "source": "mandiant-cve@google.com"
    },
    {
      "url": "https://github.com/lightdash/lightdash/pull/9295",
      "source": "mandiant-cve@google.com"
    },
    {
      "url": "https://github.com/lightdash/lightdash/releases/tag/0.1027.2",
      "source": "mandiant-cve@google.com"
    },
    {
      "url": "https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9295.patch",
      "source": "mandiant-cve@google.com"
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6586",
      "source": "mandiant-cve@google.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mandiant-cve@google.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user’s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover."
    },
    {
      "lang": "es",
      "value": "La versión 0.1024.6 de Lightdash permite a los usuarios con los permisos necesarios, como Administrador o Editor, crear y compartir paneles. Un panel que contiene elementos HTML que apuntan a una fuente controlada por un actor de amenazas puede activar una solicitud SSRF cuando se exporta, a través de una solicitud POST a /api/v1/dashboards//export. La solicitud falsificada contiene el valor del token de sesión del usuario exportador. Un actor de amenazas podría obtener el token de sesión de cualquier usuario que exporte el panel. El token de sesión obtenido se puede utilizar para realizar acciones como víctima en la aplicación, lo que da como resultado la toma de control de la sesión."
    }
  ],
  "lastModified": "2026-06-17T08:18:17.640",
  "sourceIdentifier": "mandiant-cve@google.com"
}