Vulnerability · Published May 10, 2024 · Assigned by GitHub_M

CVE-2024-31441Arbitrary File Reading in DataEase

High 7.5

In plain English

A high-severity incorrect authorization in dataease from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 53.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 1.18.19

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh x_refsource_CONFIRM