CVE-2024-23328 - The Dataease datasource exists deserialization and arbitrary file read vulnerability

Back Back to CVE browser

CRITICAL

The Dataease datasource exists deserialization and arbitrary file read vulnerability

Published Feb 1, 2024

9.1

CRITICAL

CVSS 3.1

EPSS 1.21%

Description

Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is `core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java.` The blacklist of mysql jdbc attacks can be bypassed and attackers can further exploit it for deserialized execution or reading arbitrary files. This vulnerability is patched in 1.18.15 and 2.3.0.

Affected products

Vendor Dataease Product Dataease Default
n/a
- Version
  < 1.18.15
  Status
  affected
  Constraints
  -
- Version
  >= 2.0.0, < 2.3.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Dataease

n/a

Version	Status	Constraints
< 1.18.15	affected	-
>= 2.0.0, < 2.3.0	affected	-

Vendor Dataease Product Dataease Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <1.18.15
- Version
  2.0.0
  Status
  affected
  Constraints
  <2.3.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Dataease

n/a

Version	Status	Constraints
0	affected	<1.18.15
2.0.0	affected	<2.3.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-20843
Advisory
https://github.com/dataease/dataease/commit/4128adf5fc4592b55fa1722a53b178967545d46a
x_refsource_MISCPatch
https://github.com/dataease/dataease/commit/bb540e6dc83df106ac3253f331066129a7487d1a
x_refsource_MISCPatch
https://github.com/dataease/dataease/security/advisories/GHSA-8x8q-p622-jf25
x_refsource_CONFIRMExploitVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-20843		Advisory
https://github.com/dataease/dataease/commit/4128adf5fc4592b55fa1722a53b178967545d46a		x_refsource_MISCPatch
https://github.com/dataease/dataease/commit/bb540e6dc83df106ac3253f331066129a7487d1a		x_refsource_MISCPatch
https://github.com/dataease/dataease/security/advisories/GHSA-8x8q-p622-jf25		x_refsource_CONFIRMExploitVendor Advisory