CVE-2024-3408

Name: CVE-2024-3408
Creator: NVD / NIST
Published: 2024-06-06T19:16:01.89+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 77.95%

Last modified Jun 17, 2026

CVE-2024-3408 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. EPSS estimates a 77.95% chance of exploitation in the next 30 days.

Description

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the `/update-settings` endpoint, even when `enable_custom_filters` is not enabled. This vulnerability allows attackers to bypass authentication mechanisms and execute remote code on the server.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

77.95%

99.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Man	D-Tale	3.10.0

References

https://github.com/man-group/dtale/commit/32bd6fb4a63de779ff1e51823a456865ea3cbd13
https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91Exploit, Third Party Advisory
https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91Exploit, Third Party Advisory

Timeline

Published: Jun 6, 2024
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2024-3408?

How severe is CVE-2024-3408?

CVE-2024-3408 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 77.95% probability of exploitation in the next 30 days.

How do I fix CVE-2024-3408?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-3408?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST