CVE-2025-0655
Man Group dtale Remote Code Execution (RCE)
Description
Rejected reason: ** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-55890. Notes: All CVE users should reference CVE-2024-55890 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.
INFO
Published Date :
March 20, 2025, 10:15 a.m.
Last Modified :
April 15, 2025, 4:15 p.m.
Remotely Exploit :
No
Source :
[email protected]
Solution
- Update the software to the latest version.
- Apply any available security patches.
- Consult vendor advisories for specific guidance.
Public PoC/Exploit Available at Github
CVE-2025-0655 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Vuln lab for CVE-2024-3408 - D-Tale Authentication Bypass & RCE
Dockerfile Shell Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-0655 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-0655 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by [email protected]
Apr. 15, 2025
Action Type Old Value New Value -
CVE Modified by [email protected]
Apr. 15, 2025
Action Type Old Value New Value Changed Description A vulnerability in man-group/dtale versions 3.15.1 allows an attacker to override global state settings to enable the `enable_custom_filters` feature, which is typically restricted to trusted environments. Once enabled, the attacker can exploit the /test-filter endpoint to execute arbitrary system commands, leading to remote code execution (RCE). This issue is addressed in version 3.16.1. Rejected reason: ** REJECT ** DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-55890. Notes: All CVE users should reference CVE-2024-55890 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage. Removed CVSS V3.1 NIST: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Removed CVSS V3 huntr.dev: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Removed CWE huntr.dev: CWE-78 Removed CWE NIST: CWE-78 Removed CPE Configuration OR *cpe:2.3:a:man:d-tale:3.15.1:*:*:*:*:*:*:* Removed Reference huntr.dev: https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a Removed Reference huntr.dev: https://huntr.com/bounties/f63af7bd-5438-4b36-a39b-4c90466cff13 Removed Reference CISA-ADP: https://huntr.com/bounties/f63af7bd-5438-4b36-a39b-4c90466cff13 Removed Reference Type huntr.dev: https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a Types: Patch Removed Reference Type huntr.dev: https://huntr.com/bounties/f63af7bd-5438-4b36-a39b-4c90466cff13 Types: Exploit Removed Reference Type CISA-ADP: https://huntr.com/bounties/f63af7bd-5438-4b36-a39b-4c90466cff13 Types: Exploit -
CVE Modified by [email protected]
Apr. 04, 2025
Action Type Old Value New Value Added CWE CWE-78 Removed CWE CWE-77 -
Initial Analysis by [email protected]
Apr. 01, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-78 Added CPE Configuration OR *cpe:2.3:a:man:d-tale:3.15.1:*:*:*:*:*:*:* Added Reference Type huntr.dev: https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a Types: Patch Added Reference Type CISA-ADP: https://huntr.com/bounties/f63af7bd-5438-4b36-a39b-4c90466cff13 Types: Exploit Added Reference Type huntr.dev: https://huntr.com/bounties/f63af7bd-5438-4b36-a39b-4c90466cff13 Types: Exploit -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Mar. 20, 2025
Action Type Old Value New Value Added Reference https://huntr.com/bounties/f63af7bd-5438-4b36-a39b-4c90466cff13 -
New CVE Received by [email protected]
Mar. 20, 2025
Action Type Old Value New Value Added Description A vulnerability in man-group/dtale versions 3.15.1 allows an attacker to override global state settings to enable the `enable_custom_filters` feature, which is typically restricted to trusted environments. Once enabled, the attacker can exploit the /test-filter endpoint to execute arbitrary system commands, leading to remote code execution (RCE). This issue is addressed in version 3.16.1. Added CVSS V3 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-77 Added Reference https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a Added Reference https://huntr.com/bounties/f63af7bd-5438-4b36-a39b-4c90466cff13