# Incorrect access control in Jupyter notebooks[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2021-27225.html#incorrect-access-control-in-jupyter-notebooks "Permalink to this headline")

## Information[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2021-27225.html#information "Permalink to this headline")

* CVE Id: CVE-2021-27225

* CVSS Base Score: 5.4

* Severity: Medium

* CWE classification: CWE-284

## Credits[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2021-27225.html#credits "Permalink to this headline")

Dataiku would like to thank Xiejingwei Fei (jack dot fei at finra dot org) for discovering and reporting this vulnerability.

## Summary[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2021-27225.html#summary "Permalink to this headline")

In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have coding permissions) to read and overwrite notebooks in projects that they are not authorized to access.

In order to exploit the vulnerability, the attacker must have coding permissions in Dataiku DSS and write access to a project, and must send specially-crafted HTTP queries.

## Affected Products[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2021-27225.html#affected-products "Permalink to this headline")

Dataiku DSS in versions before 8.0.6

## Mitigation[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2021-27225.html#mitigation "Permalink to this headline")

Dataiku DSS 8.0.6 has been made available to customers to remediate this issue
