CVE-2023-37258

Опубликовано: 25 июл. 2023

Источник: nvd

CVSS3: 8.8

CVSS3: 9.8

EPSS Низкий

Описание

DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, DataEase has a SQL injection vulnerability that can bypass blacklists. The vulnerability has been fixed in v1.18.9. There are no known workarounds.

Ссылки

https://github.com/dataease/dataease/blob/dev/backend/src/main/java/io/dataease/controller/panel/AppLogController.java#L41
Product
https://github.com/dataease/dataease/blob/dev/backend/src/main/java/io/dataease/ext/ExtDataSourceMapper.java
Product
https://github.com/dataease/dataease/security/advisories/GHSA-r39x-fcc6-47g4
Exploit
Vendor Advisory
https://github.com/dataease/dataease/blob/dev/backend/src/main/java/io/dataease/controller/panel/AppLogController.java#L41
Product
https://github.com/dataease/dataease/blob/dev/backend/src/main/java/io/dataease/ext/ExtDataSourceMapper.java
Product
https://github.com/dataease/dataease/security/advisories/GHSA-r39x-fcc6-47g4
Exploit
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*

Версия до 1.18.9 (исключая)

EPSS

Процентиль: 41%

0.00187

Низкий

8.8 High

CVSS3

9.8 Critical

CVSS3

Дефекты

CWE-89

EPSS

Процентиль: 41%

0.00187

Низкий

8.8 High

CVSS3

9.8 Critical

CVSS3

Дефекты

CWE-89