CVE-2024-45595

Medium

Published: 10 September 2024

Published

10 September 2024

Modified

20 September 2024

KEV Added

—

Patch

—

CVSS Score v3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score 0.0163 82.3th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-45595 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Man D-Tale. Its CVSS base score is 6.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Data Processing Libraries; in the Other ATLAS/OWASP Terms risk domain.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-2849

Vulnerability details

D-Tale is a visualizer for Pandas data structures. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.14.1 where the "Custom Filter" input is…

turned off by default.

CWE(s): CWE-79 NVD-CWE-noinfo

AI Security AnalysisAI

AI Category: Data Processing Libraries
Risk Domain: Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025: None mapped
Classification Reason: D-Tale is a visualizer specifically for Pandas data structures, and Pandas is a core data processing library widely used in AI/ML workflows for data manipulation and preparation.

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2024-45595 enables remote code execution via a publicly hosted D-Tale web application through the 'Custom Filter' input, directly facilitating T1190: Exploit Public-Facing Application.