Vulnerability · Published Nov 7, 2024 · Assigned by GitHub_M
CVE-2024-47073Dataease arbitrary interface access vulnerability
Critical 9.3
In plain English
A critical-severity security flaw in dataease from dataease. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 70% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The vulnerability has been fixed in v2.10.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected products (as reported)
Weakness: CWE-347 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/dataease/dataease/security/advisories/GHSA-5jr4-wrm2-xj36 x_refsource_CONFIRM