SQL Injection Vulnerability in DataEase by DataEase Team
CVE-2023-40771

7.5HIGH

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
1 September 2023

What is CVE-2023-40771?

A SQL injection vulnerability in DataEase version 1.18.9 enables remote attackers to exploit the application by injecting malicious strings that bypass input validation mechanisms, thus granting unauthorized access to sensitive information. Attackers can leverage this flaw to manipulate database queries and extract confidential data, posing significant risks to data integrity and confidentiality.

References

https://github.com/dataease/dataease/issues/5861

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.