Io.dataease Dataease-plugin-common CVEs
7 CVEs, 4 protected by Waratek
Overview 7 matches · 4 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
4
57.1%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
42.9%
blocked by ARMR today
4
57.1%
partly blocked
0
0.0%
not blocked
3
42.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
3
42.9%
Forecast only
0
0.0%
No public exploit
4
57.1%
split by
peak 4 / month
Jul 224
Protected by Waratek2
No exploit published2
Critical2
High1
Medium1
blocked by ARMR today2
not blocked2
No public exploit4
Aug 220
Sep 220
Oct 221
Protected by Waratek1
Critical1
blocked by ARMR today1
Proof of concept only1
Nov 220
Dec 220
Jan 230
Feb 230
Mar 230
Apr 230
May 230
Jun 231
No exploit published1
High1
not blocked1
Proof of concept only1
Jul 230
Aug 230
Sep 231
Protected by Waratek1
High1
blocked by ARMR today1
Proof of concept only1
Jul 22Sep 22Nov 22Jan 23Mar 23May 23Jul 23Sep 23
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-40771 | High | 2023-09-01 | Protected by Waratek | Proof of concept only | SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function. |
| CVE-2023-32310 | High | 2023-06-01 | No exploit published | Proof of concept only | DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboard or messages or interfering with the interface for marking messages read. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading. |
| CVE-2022-39312 | Critical | 2022-10-25 | Protected by Waratek | Proof of concept only | Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue. |
| CVE-2022-34115 | Critical | 2022-07-22 | Protected by Waratek | No public exploit | DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId. |
| CVE-2022-34114 | High | 2022-07-22 | Protected by Waratek | No public exploit | Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId. |
| CVE-2022-34113 | Critical | 2022-07-22 | No exploit published | No public exploit | An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. |
| CVE-2022-34112 | Medium | 2022-07-22 | No exploit published | No public exploit | An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator. |