# Session credential disclosure[¶](https://doc.dataiku.com/dss/latest/security/advisories/dsa-2022-012.html#session-credential-disclosure "Permalink to this headline")

## Information[¶](https://doc.dataiku.com/dss/latest/security/advisories/dsa-2022-012.html#information "Permalink to this headline")

* Advisory ID: DSA-2022-012

* CVSS String: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

* CVSS Base Score: 8.8 (High)

* CWE classification: CWE-200

## Summary[¶](https://doc.dataiku.com/dss/latest/security/advisories/dsa-2022-012.html#summary "Permalink to this headline")

It was discovered that a user’s internal session credential was mistakenly written to a location that can be obtained by attackers who have access to the same project as the victim. This could lead to account takeover.

## Affected Products[¶](https://doc.dataiku.com/dss/latest/security/advisories/dsa-2022-012.html#affected-products "Permalink to this headline")

* Dataiku DSS 9 and older versions

* Dataiku DSS 10 before 10.0.9

* Dataiku DSS 11 before 11.0.3

## Fix[¶](https://doc.dataiku.com/dss/latest/security/advisories/dsa-2022-012.html#fix "Permalink to this headline")

Dataiku DSS 10.0.9 and Dataiku DSS 11.0.3 have been made available to customers to remediate this issue
