VulnSocial

CVE-2024-3408Disclosure(man / d-tale)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the `/update-settings` endpoint, even when `enable_custom_filters` is not enabled. This vulnerability allows attackers to bypass authentication mechanisms and execute remote code on the server.

man CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-798CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • d-tale

Threat summary

  • Public PoC is present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
man
Products
d-tale

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-06-07: 1PoC Mentioned / Linked · 2026-06-07: 1Technical Details · 2026-06-07: 106-07
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2024-3408 - critical 🚨 D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution > man-group/dtale 3.10.0 contains an authentication bypass and remote code execution ca... 👾 https://cloud.projectdiscovery.io/library/CVE-2024-3408 @pdnuclei #NucleiTemplat...

    Post summary

    CVE-2024-3408 exposes an authentication bypass that allows remote code execution in D‑Tale versions 3.10.0 through 3.15.1, with a ProjectDiscovery link providing detection code.

    0103290
    1.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmand-tale3.10.0--

Explore more

Back to dashboardman CVEsd-tale vulnerabilities