WaratekVRT Sign in

Critical Io.dataease Dataease-plugin-common CVEs

3 CVEs, 2 protected by Waratek

Reset
More filters (2)
Columns
Vendor io.dataease✕Product dataease-plugin-common✕
Overview 3 matches · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
3matches 2protected66.7% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 66.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 33.3%
Critical 3 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 66.7% partly blocked 0 0.0% not blocked 1 33.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 33.3% Forecast only 0 0.0% No public exploit 2 66.7%
split by peak 2 / month
No exploit published: 1Protected by Waratek: 2 Critical: 3 not blocked: 1blocked by ARMR today: 2 No public exploit: 2Proof of concept only: 1
Jul 222 Protected by Waratek1 No exploit published1 Critical2 blocked by ARMR today1 not blocked1 No public exploit2 Aug 220 Sep 220 Oct 221 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1
Jul 22Aug 22Sep 22Oct 22
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-39312 Critical 2022-10-25 Protected by Waratek Proof of concept only Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue.
CVE-2022-34115 Critical 2022-07-22 Protected by Waratek No public exploit DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.
CVE-2022-34113 Critical 2022-07-22 No exploit published No public exploit An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.