DataEase dashboard has a stored XSS vulnerability
CVE-2023-25807

7.2HIGH

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
28 February 2023

What is CVE-2023-25807?

DataEase, an open-source data visualization and analysis tool, contains a vulnerability allowing attackers to modify saved data when users save a dashboard. This flaw can enable the execution of malicious code on the server, potentially compromising the integrity of the application and its users. Users are encouraged to update to version 1.18.3 or later to mitigate this risk.

Affected Version(s)

dataease < 1.18.3

References

https://github.com/dataease/dataease/security/advisories/...
x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/cc94fb8e69ddb...
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.