Описание
Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.
Ссылки
- Patch
- Release Notes
- ExploitVendor Advisory
- ExploitVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.10.17 (исключая)
cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*
EPSS
Процентиль: 22%
0.00072
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-74
EPSS
Процентиль: 22%
0.00072
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-74