Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-23328

Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is `core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java.` The blacklist of mysql jdbc attacks can be bypassed and attackers can further exploit it for deserialized execution or reading arbitrary files. This vulnerability is patched in 1.18.15 and 2.3.0.

Published

2024-02-29T01:44:08.483

Last Modified

2025-01-08T18:52:16.350

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.1 (CRITICAL)

Weaknesses

Type: Secondary
CWE-502
Type: Primary
CWE-502

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	dataease	dataease	< 1.18.15	Yes
Application	dataease	dataease	< 2.3.0	Yes

References

https://github.com/dataease/dataease/commit/4128adf5fc4592b55fa1722a53b178967545d46a Patch ([email protected])
https://github.com/dataease/dataease/commit/bb540e6dc83df106ac3253f331066129a7487d1a Patch ([email protected])
https://github.com/dataease/dataease/security/advisories/GHSA-8x8q-p622-jf25 Exploit, Vendor Advisory ([email protected])
https://github.com/dataease/dataease/commit/4128adf5fc4592b55fa1722a53b178967545d46a Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/dataease/dataease/commit/bb540e6dc83df106ac3253f331066129a7487d1a Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/dataease/dataease/security/advisories/GHSA-8x8q-p622-jf25 Exploit, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)