Search

Find a vulnerability

Search criteria Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    8 vulnerabilities found for lightdash by lightdash

    CVE-2026-72846 (GCVE-0-2026-72846)

    Vulnerability from nvd – Published: 2026-08-20 21:57 – Updated: 2026-08-21 15:39
    VLAI
    Title
    Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery
    Summary
    Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-21 15:38 UTC
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Impacted products
    Vendor Product Version
    lightdash lightdash Affected: 0 , < 1.146.4 (semver)
    Unaffected: 1.146.4 (semver)
    Create a notification for this product.
    Date Public
    2026-06-17 00:00
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-72846",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-21T15:38:39.102270Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-21T15:39:22.777Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/lightdash/lightdash/issues/24389"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageURL": "pkg:npm/lightdash",
              "product": "lightdash",
              "programFiles": [
                "packages/backend/src/clients/GoogleChat/GoogleChatClient.ts",
                "packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts"
              ],
              "repo": "https://github.com/lightdash/lightdash",
              "vendor": "lightdash",
              "versions": [
                {
                  "lessThan": "1.146.4",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "1.146.4",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "George Chen"
            }
          ],
          "datePublic": "2026-06-17T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS"
            },
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "LOW",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-21T11:20:59.612Z",
            "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
            "shortName": "VulnCheck"
          },
          "references": [
            {
              "name": "GitHub Issue #24389",
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/lightdash/lightdash/issues/24389"
            },
            {
              "name": "sendWebhook calling fetch on the stored URL at 1.146.3",
              "tags": [
                "technical-description"
              ],
              "url": "https://github.com/lightdash/lightdash/blob/1.146.3/packages/backend/src/clients/GoogleChat/GoogleChatClient.ts"
            },
            {
              "name": "sendWebhook calling fetch on the stored URL at 1.146.3 (Microsoft Teams)",
              "tags": [
                "technical-description"
              ],
              "url": "https://github.com/lightdash/lightdash/blob/1.146.3/packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts"
            },
            {
              "name": "Lightdash 1.146.4 Release Notes",
              "tags": [
                "release-notes"
              ],
              "url": "https://github.com/lightdash/lightdash/releases/tag/1.146.4"
            },
            {
              "tags": [
                "product"
              ],
              "url": "https://github.com/lightdash/lightdash"
            },
            {
              "name": "VulnCheck Advisory: Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://www.vulncheck.com/advisories/lightdash-scheduled-delivery-webhook-urls-are-not-validated-allowing-server-side-request-forgery"
            }
          ],
          "title": "Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery",
          "x_generator": {
            "engine": "vulncheck-endgame"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "assignerShortName": "VulnCheck",
        "cveId": "CVE-2026-72846",
        "datePublished": "2026-08-20T21:57:35.568Z",
        "dateReserved": "2026-08-10T15:14:51.467Z",
        "dateUpdated": "2026-08-21T15:39:22.777Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2024-6586 (GCVE-0-2024-6586)

    Vulnerability from nvd – Published: 2024-08-30 22:25 – Updated: 2024-09-03 14:50
    VLAI
    Summary
    Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user’s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-09-03 14:48 UTC
    CWE
    • CWE-201 - Insertion of Sensitive Information Into Sent Data
    Impacted products
    Vendor Product Version
    Lightdash Lightdash Affected: 0.1024.6 , < 0.1027.2 (custom)
    Create a notification for this product.
    lightdash lightdash Affected: 0.1024.6 , < 0.1027.2 (custom)
        cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "lightdash",
                "vendor": "lightdash",
                "versions": [
                  {
                    "lessThan": "0.1027.2",
                    "status": "affected",
                    "version": "0.1024.6",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 7.3,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "REQUIRED",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-6586",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-03T14:48:51.247263Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-03T14:50:25.611Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "affected",
              "product": "Lightdash",
              "vendor": "Lightdash",
              "versions": [
                {
                  "changes": [
                    {
                      "at": "0.1027.2",
                      "status": "unaffected"
                    }
                  ],
                  "lessThan": "0.1027.2",
                  "status": "affected",
                  "version": "0.1024.6",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Kenneth Chiong, Mandiant"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Kenneth Chiong, Mandiant"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover."
                }
              ],
              "value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-201",
                  "description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-08-30T22:25:48.431Z",
            "orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
            "shortName": "Mandiant"
          },
          "references": [
            {
              "url": "https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf"
            },
            {
              "url": "https://www.cve.org/CVERecord?id=CVE-2024-6586"
            },
            {
              "url": "https://github.com/lightdash/lightdash"
            },
            {
              "url": "https://github.com/lightdash/lightdash/releases/tag/0.1027.2"
            },
            {
              "url": "https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9295.patch"
            },
            {
              "url": "https://github.com/lightdash/lightdash/pull/9295"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
        "assignerShortName": "Mandiant",
        "cveId": "CVE-2024-6586",
        "datePublished": "2024-08-30T22:25:48.431Z",
        "dateReserved": "2024-07-08T21:24:57.730Z",
        "dateUpdated": "2024-09-03T14:50:25.611Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }

    CVE-2024-6585 (GCVE-0-2024-6585)

    Vulnerability from nvd – Published: 2024-08-30 22:17 – Updated: 2024-09-03 14:52
    VLAI
    Summary
    Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to inject malicious scripts into vulnerable web pages. A threat actor could potentially exploit this vulnerability to store malicious JavaScript which executes in the context of a user’s session with the application.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-09-03 14:50 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Impacted products
    Vendor Product Version
    Lightdash Lightdash Affected: 0.1024.6 , < 0.1042.2 (custom)
    Create a notification for this product.
    lightdash lightdash Affected: 0.1024.6 , < 0.1042.2 (custom)
        cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "lightdash",
                "vendor": "lightdash",
                "versions": [
                  {
                    "lessThan": "0.1042.2",
                    "status": "affected",
                    "version": "0.1024.6",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 5.4,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "LOW",
                  "integrityImpact": "LOW",
                  "privilegesRequired": "LOW",
                  "scope": "CHANGED",
                  "userInteraction": "REQUIRED",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-6585",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-03T14:50:48.806492Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-03T14:52:05.350Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://github.com/lightdash/lightdash",
              "defaultStatus": "affected",
              "product": "Lightdash",
              "vendor": "Lightdash",
              "versions": [
                {
                  "changes": [
                    {
                      "at": "0.1042.2",
                      "status": "unaffected"
                    }
                  ],
                  "lessThan": "0.1042.2",
                  "status": "affected",
                  "version": "0.1024.6",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Kenneth Chiong, Mandiant"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Kenneth Chiong, Mandiant"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Multiple stored cross-site scripting (\u201cXSS\u201d) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to inject malicious scripts into vulnerable web pages. A threat actor could potentially exploit this vulnerability to store malicious JavaScript which executes in the context of a user\u2019s session with the application."
                }
              ],
              "value": "Multiple stored cross-site scripting (\u201cXSS\u201d) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to inject malicious scripts into vulnerable web pages. A threat actor could potentially exploit this vulnerability to store malicious JavaScript which executes in the context of a user\u2019s session with the application."
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "xss"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-08-30T22:20:44.647Z",
            "orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
            "shortName": "Mandiant"
          },
          "references": [
            {
              "url": "https://github.com/google/security-research/security/advisories/GHSA-6529-6jv3-66q2"
            },
            {
              "url": "https://www.cve.org/CVERecord?id=CVE-2024-6585"
            },
            {
              "url": "https://github.com/lightdash/lightdash"
            },
            {
              "url": "https://github.com/lightdash/lightdash/releases/tag/0.1042.2"
            },
            {
              "url": "https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9510.patch"
            },
            {
              "url": "https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9359.patch"
            },
            {
              "url": "https://github.com/lightdash/lightdash/pull/9510"
            },
            {
              "url": "https://github.com/lightdash/lightdash/pull/9359"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
        "assignerShortName": "Mandiant",
        "cveId": "CVE-2024-6585",
        "datePublished": "2024-08-30T22:17:28.565Z",
        "dateReserved": "2024-07-08T21:24:56.349Z",
        "dateUpdated": "2024-09-03T14:52:05.350Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }

    CVE-2023-35844 (GCVE-0-2023-35844)

    Vulnerability from nvd – Published: 2023-06-19 00:00 – Updated: 2024-12-11 20:12
    VLAI Shadowserver KEVIntel
    Summary
    packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-12-11 20:11 UTC
    CWE
    • n/a
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T16:30:45.363Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://advisory.dw1.io/59"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/lightdash/lightdash/compare/0.510.2...0.510.3"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/lightdash/lightdash/pull/5090"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 7.5,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-35844",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-12-11T20:11:31.672177Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-22",
                    "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-12-11T20:12:03.427Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "n/a",
              "vendor": "n/a",
              "versions": [
                {
                  "status": "affected",
                  "version": "n/a"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "n/a",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-06-19T00:00:00.000Z",
            "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            "shortName": "mitre"
          },
          "references": [
            {
              "url": "https://advisory.dw1.io/59"
            },
            {
              "url": "https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c"
            },
            {
              "url": "https://github.com/lightdash/lightdash/compare/0.510.2...0.510.3"
            },
            {
              "url": "https://github.com/lightdash/lightdash/pull/5090"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "assignerShortName": "mitre",
        "cveId": "CVE-2023-35844",
        "datePublished": "2023-06-19T00:00:00.000Z",
        "dateReserved": "2023-06-19T00:00:00.000Z",
        "dateUpdated": "2024-12-11T20:12:03.427Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }

    CVE-2026-72846 (GCVE-0-2026-72846)

    Vulnerability from cvelistv5 – Published: 2026-08-20 21:57 – Updated: 2026-08-21 15:39
    VLAI
    Title
    Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery
    Summary
    Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-21 15:38 UTC
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Impacted products
    Vendor Product Version
    lightdash lightdash Affected: 0 , < 1.146.4 (semver)
    Unaffected: 1.146.4 (semver)
    Create a notification for this product.
    Date Public
    2026-06-17 00:00
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-72846",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-21T15:38:39.102270Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-21T15:39:22.777Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/lightdash/lightdash/issues/24389"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageURL": "pkg:npm/lightdash",
              "product": "lightdash",
              "programFiles": [
                "packages/backend/src/clients/GoogleChat/GoogleChatClient.ts",
                "packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts"
              ],
              "repo": "https://github.com/lightdash/lightdash",
              "vendor": "lightdash",
              "versions": [
                {
                  "lessThan": "1.146.4",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "1.146.4",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "George Chen"
            }
          ],
          "datePublic": "2026-06-17T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS"
            },
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "LOW",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-21T11:20:59.612Z",
            "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
            "shortName": "VulnCheck"
          },
          "references": [
            {
              "name": "GitHub Issue #24389",
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/lightdash/lightdash/issues/24389"
            },
            {
              "name": "sendWebhook calling fetch on the stored URL at 1.146.3",
              "tags": [
                "technical-description"
              ],
              "url": "https://github.com/lightdash/lightdash/blob/1.146.3/packages/backend/src/clients/GoogleChat/GoogleChatClient.ts"
            },
            {
              "name": "sendWebhook calling fetch on the stored URL at 1.146.3 (Microsoft Teams)",
              "tags": [
                "technical-description"
              ],
              "url": "https://github.com/lightdash/lightdash/blob/1.146.3/packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts"
            },
            {
              "name": "Lightdash 1.146.4 Release Notes",
              "tags": [
                "release-notes"
              ],
              "url": "https://github.com/lightdash/lightdash/releases/tag/1.146.4"
            },
            {
              "tags": [
                "product"
              ],
              "url": "https://github.com/lightdash/lightdash"
            },
            {
              "name": "VulnCheck Advisory: Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://www.vulncheck.com/advisories/lightdash-scheduled-delivery-webhook-urls-are-not-validated-allowing-server-side-request-forgery"
            }
          ],
          "title": "Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery",
          "x_generator": {
            "engine": "vulncheck-endgame"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "assignerShortName": "VulnCheck",
        "cveId": "CVE-2026-72846",
        "datePublished": "2026-08-20T21:57:35.568Z",
        "dateReserved": "2026-08-10T15:14:51.467Z",
        "dateUpdated": "2026-08-21T15:39:22.777Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2024-6586 (GCVE-0-2024-6586)

    Vulnerability from cvelistv5 – Published: 2024-08-30 22:25 – Updated: 2024-09-03 14:50
    VLAI
    Summary
    Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user’s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-09-03 14:48 UTC
    CWE
    • CWE-201 - Insertion of Sensitive Information Into Sent Data
    Impacted products
    Vendor Product Version
    Lightdash Lightdash Affected: 0.1024.6 , < 0.1027.2 (custom)
    Create a notification for this product.
    lightdash lightdash Affected: 0.1024.6 , < 0.1027.2 (custom)
        cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "lightdash",
                "vendor": "lightdash",
                "versions": [
                  {
                    "lessThan": "0.1027.2",
                    "status": "affected",
                    "version": "0.1024.6",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 7.3,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "REQUIRED",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-6586",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-03T14:48:51.247263Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-03T14:50:25.611Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "affected",
              "product": "Lightdash",
              "vendor": "Lightdash",
              "versions": [
                {
                  "changes": [
                    {
                      "at": "0.1027.2",
                      "status": "unaffected"
                    }
                  ],
                  "lessThan": "0.1027.2",
                  "status": "affected",
                  "version": "0.1024.6",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Kenneth Chiong, Mandiant"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Kenneth Chiong, Mandiant"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover."
                }
              ],
              "value": "Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user\u2019s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-201",
                  "description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-08-30T22:25:48.431Z",
            "orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
            "shortName": "Mandiant"
          },
          "references": [
            {
              "url": "https://github.com/google/security-research/security/advisories/GHSA-4h7x-6vxh-7hjf"
            },
            {
              "url": "https://www.cve.org/CVERecord?id=CVE-2024-6586"
            },
            {
              "url": "https://github.com/lightdash/lightdash"
            },
            {
              "url": "https://github.com/lightdash/lightdash/releases/tag/0.1027.2"
            },
            {
              "url": "https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9295.patch"
            },
            {
              "url": "https://github.com/lightdash/lightdash/pull/9295"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
        "assignerShortName": "Mandiant",
        "cveId": "CVE-2024-6586",
        "datePublished": "2024-08-30T22:25:48.431Z",
        "dateReserved": "2024-07-08T21:24:57.730Z",
        "dateUpdated": "2024-09-03T14:50:25.611Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }

    CVE-2024-6585 (GCVE-0-2024-6585)

    Vulnerability from cvelistv5 – Published: 2024-08-30 22:17 – Updated: 2024-09-03 14:52
    VLAI
    Summary
    Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to inject malicious scripts into vulnerable web pages. A threat actor could potentially exploit this vulnerability to store malicious JavaScript which executes in the context of a user’s session with the application.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-09-03 14:50 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Impacted products
    Vendor Product Version
    Lightdash Lightdash Affected: 0.1024.6 , < 0.1042.2 (custom)
    Create a notification for this product.
    lightdash lightdash Affected: 0.1024.6 , < 0.1042.2 (custom)
        cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "lightdash",
                "vendor": "lightdash",
                "versions": [
                  {
                    "lessThan": "0.1042.2",
                    "status": "affected",
                    "version": "0.1024.6",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 5.4,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "LOW",
                  "integrityImpact": "LOW",
                  "privilegesRequired": "LOW",
                  "scope": "CHANGED",
                  "userInteraction": "REQUIRED",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-6585",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-03T14:50:48.806492Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-03T14:52:05.350Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://github.com/lightdash/lightdash",
              "defaultStatus": "affected",
              "product": "Lightdash",
              "vendor": "Lightdash",
              "versions": [
                {
                  "changes": [
                    {
                      "at": "0.1042.2",
                      "status": "unaffected"
                    }
                  ],
                  "lessThan": "0.1042.2",
                  "status": "affected",
                  "version": "0.1024.6",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Kenneth Chiong, Mandiant"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "Kenneth Chiong, Mandiant"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Multiple stored cross-site scripting (\u201cXSS\u201d) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to inject malicious scripts into vulnerable web pages. A threat actor could potentially exploit this vulnerability to store malicious JavaScript which executes in the context of a user\u2019s session with the application."
                }
              ],
              "value": "Multiple stored cross-site scripting (\u201cXSS\u201d) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to inject malicious scripts into vulnerable web pages. A threat actor could potentially exploit this vulnerability to store malicious JavaScript which executes in the context of a user\u2019s session with the application."
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "xss"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-08-30T22:20:44.647Z",
            "orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
            "shortName": "Mandiant"
          },
          "references": [
            {
              "url": "https://github.com/google/security-research/security/advisories/GHSA-6529-6jv3-66q2"
            },
            {
              "url": "https://www.cve.org/CVERecord?id=CVE-2024-6585"
            },
            {
              "url": "https://github.com/lightdash/lightdash"
            },
            {
              "url": "https://github.com/lightdash/lightdash/releases/tag/0.1042.2"
            },
            {
              "url": "https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9510.patch"
            },
            {
              "url": "https://patch-diff.githubusercontent.com/raw/lightdash/lightdash/pull/9359.patch"
            },
            {
              "url": "https://github.com/lightdash/lightdash/pull/9510"
            },
            {
              "url": "https://github.com/lightdash/lightdash/pull/9359"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484",
        "assignerShortName": "Mandiant",
        "cveId": "CVE-2024-6585",
        "datePublished": "2024-08-30T22:17:28.565Z",
        "dateReserved": "2024-07-08T21:24:56.349Z",
        "dateUpdated": "2024-09-03T14:52:05.350Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }

    CVE-2023-35844 (GCVE-0-2023-35844)

    Vulnerability from cvelistv5 – Published: 2023-06-19 00:00 – Updated: 2024-12-11 20:12
    VLAI Shadowserver KEVIntel
    Summary
    packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-12-11 20:11 UTC
    CWE
    • n/a
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T16:30:45.363Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://advisory.dw1.io/59"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/lightdash/lightdash/compare/0.510.2...0.510.3"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/lightdash/lightdash/pull/5090"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 7.5,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-35844",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-12-11T20:11:31.672177Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-22",
                    "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-12-11T20:12:03.427Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "n/a",
              "vendor": "n/a",
              "versions": [
                {
                  "status": "affected",
                  "version": "n/a"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension (.csv or .png) is used."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "n/a",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-06-19T00:00:00.000Z",
            "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            "shortName": "mitre"
          },
          "references": [
            {
              "url": "https://advisory.dw1.io/59"
            },
            {
              "url": "https://github.com/lightdash/lightdash/commit/fcc808c84c2cc3afb343063e32a49440d32a553c"
            },
            {
              "url": "https://github.com/lightdash/lightdash/compare/0.510.2...0.510.3"
            },
            {
              "url": "https://github.com/lightdash/lightdash/pull/5090"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "assignerShortName": "mitre",
        "cveId": "CVE-2023-35844",
        "datePublished": "2023-06-19T00:00:00.000Z",
        "dateReserved": "2023-06-19T00:00:00.000Z",
        "dateUpdated": "2024-12-11T20:12:03.427Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }