Authentication Bypass Risk in DataEase Data Visualization Tool

CVE-2024-56511

What is CVE-2024-56511?

DataEase, an open-source data visualization analysis tool, contains an authentication flaw that allows attackers to bypass security mechanisms and gain unauthorized access. The issue resides within the ‘io.dataease.auth.filter.TokenFilter’ class, where the ability to determine if a URL request requires authentication can be circumvented. Specifically, due to insufficient filtering of URL patterns when users set the 'server.servlet.context-path', malicious actors can exploit this weakness using tailored request URIs. This vulnerability was addressed in version 2.10.4, underscoring the importance of updating to secure systems against potential threats.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References