Description
In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have coding permissions) to read and overwrite notebooks in projects that they are not authorized to access.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://doc.dataiku.com/dss/latest/
Vendor Advisory x_refsource_confirm
https://doc.dataiku.com/dss/8.0/security/advisories/cve-2021-27225.html
Scores
CVSS v3
5.4
EPSS
0.0052
EPSS Percentile
39.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Details
CWE
CWE-863
Status
published
Products (1)
dataiku/data_science_studio
< 8.0.6
Published
Mar 01, 2021
Tracked Since
Feb 18, 2026