# Ability to tamper with creation and ownership metadata[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-8817.html#ability-to-tamper-with-creation-and-ownership-metadata "Permalink to this headline")

## Information[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-8817.html#information "Permalink to this headline")

* CVE Id: CVE-2020-8817

* CVSS Base Score: 4.3

* Severity: Medium

* CWE classification: CWE-284

## Summary[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-8817.html#summary "Permalink to this headline")

The “Created by” metadata displayed in the right column for most Dataiku object types (datasets, Wiki articles, dashboards, …) can be tampered with by users with write access to the project.

Although the audit trail and history log always reference the proper information, this allows hostile attackers to display misleading metadata information in the right column.

## Affected Products[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-8817.html#affected-products "Permalink to this headline")

Dataiku DSS in versions before 6.0.5

## Mitigation[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-8817.html#mitigation "Permalink to this headline")

Dataiku DSS 6.0.5 has been made available to customers to remediate this issue.

## Credits[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-8817.html#credits "Permalink to this headline")

This vulnerability was discovered and reported by Fábio Freitas (@0xfabiof). Thanks!
