CVE-2018-10732 PoC — Dataiku DSS REST API 安全漏洞

Source

https://github.com/alt3kx/CVE-2018-10732

Associated Vulnerability

Title: Dataiku DSS REST API 安全漏洞 (CVE-2018-10732)
Description:The REST API in Dataiku DSS before 4.2.3 allows remote attackers to obtain sensitive information (i.e., determine if a username is valid) because of profile pictures visibility.

Description

Dataiku REST-API by default the software, allows anonymous access to functionality that allows an attacker to know valid users.

Readme

# CVE-2018-10732
Exploit-DB publication at:  No disclosure! 

# Dataiku vendor Patch and Credits:
https://doc.dataiku.com/dss/latest/release_notes/4.2.html#security


![cve-2018-10732_credits](https://user-images.githubusercontent.com/3140111/40872864-29c152ee-6656-11e8-9704-819d64b1a045.png)

# Author
Alex Hernandez aka <em><a href="https://twitter.com/_alt3kx_" rel="nofollow">(@\_alt3kx\_)</a></em>

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →