Vulnerability · Published Sep 23, 2024 · Assigned by GitHub_M

CVE-2024-46985DataEase has an XXE vulnerability

High 7.5

In plain English

A high-severity XML external entity in dataease from dataease. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 48.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.dataease:common	2.10.1	GHSA-4m9p-7xg6-f4mm

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.1

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-4m9p-7xg6-f4mm x_refsource_CONFIRM