Deserialization vulnerability in DataEase datasource can lead to arbitrary code execution
CVE-2024-23328
What is CVE-2024-23328?
DataEase, an open-source data visualization analysis tool, has encountered a deserialization vulnerability that poses risks of arbitrary code execution. The vulnerability originates from the MySQL datasource component, precisely located in core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java. This flaw permits attackers to bypass the existing blacklist of MySQL JDBC attacks, enabling them to exploit the system for deserialization execution or unauthorized access to arbitrary files. The issue has been addressed and patched in DataEase versions 1.18.15 and 2.3.0. It is crucial for users of affected versions to update promptly to mitigate potential risks associated with this vulnerability.
Affected Version(s)
dataease < 1.18.15 < 1.18.15
dataease >= 2.0.0, < 2.3.0 < 2.0.0, 2.3.0