Arbitrary File Reading Vulnerability in DataEase

CVE-2024-31441

7.5HIGH

Key Information

Vendor: Dataease
Status: Dataease
Vendor: CVE Published:; 14 May 2024

Summary

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19.

Affected Version(s)

dataease = < 1.18.19

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
May 14, 2024
Vulnerability Reserved.
Apr 3, 2024

Collectors

NVD DatabaseMitre Database