Vulnerability · Published Apr 8, 2024 · Assigned by GitHub_M

CVE-2024-30269DataEase has database configuration information exposure vulnerability

Medium 5.3

In plain English

A medium-severity information exposure in dataease from dataease. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 15.9% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)15.9%top 3.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.5.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-8gvx-4qvj-6vv5 x_refsource_CONFIRM
https://github.com/dataease/dataease/releases/tag/v2.5.0 x_refsource_MISC