CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-28437 – SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed
https://notcve.org/view.php?id=CVE-2023-28437
Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds. • https://github.com/dataease/dataease/issues/4795 https://github.com/dataease/dataease/releases/tag/v1.18.5 https://github.com/dataease/dataease/security/advisories/GHSA-7j7j-9rw6-3r56 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2023-28435 – Dataease file upload interface does not verify permission or file type
https://notcve.org/view.php?id=CVE-2023-28435
Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5. • https://github.com/dataease/dataease/issues/4798 https://github.com/dataease/dataease/security/advisories/GHSA-625h-q3g9-rffc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2023-25807 – DataEase dashboard has a stored XSS vulnerability
https://notcve.org/view.php?id=CVE-2023-25807
DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses the dashboard. The vulnerability has been fixed in version 1.18.3. • https://github.com/dataease/dataease/commit/cc94fb8e69ddbb37c96d02ec0f0ddcd74273ef49 https://github.com/dataease/dataease/security/advisories/GHSA-xj3h-3wmw-j5vf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-38239
https://notcve.org/view.php?id=CVE-2021-38239
SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10. • https://github.com/dataease/dataease/issues/510 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-39312 – Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability
https://notcve.org/view.php?id=CVE-2022-39312
Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. • https://github.com/dataease/dataease/commit/956ee2d6c9e81349a60aef435efc046888e10a6d https://github.com/dataease/dataease/pull/3328 https://github.com/dataease/dataease/releases/tag/v1.15.2 https://github.com/dataease/dataease/security/advisories/GHSA-q4qq-jhjv-7rh2 • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •