Arbitrary File Deserialization Vulnerability in DataEase Analytics Tool

CVE-2024-55953

What is CVE-2024-55953?

A vulnerability exists in the DataEase analytics tool that allows authenticated users to read and deserialize arbitrary files due to improper filtering of parameters in the JDBC connection string. This flaw could potentially enable attackers to exploit the system by accessing sensitive data or executing arbitrary code. The issue has been addressed in version 1.18.27, and users are strongly encouraged to update their installations immediately, as there are no known workarounds available to mitigate the risks associated with this vulnerability.

References