io.dataease/dataease-plugin-common vulnerabilities

Latest io.dataease/dataease-plugin-common CVEs

Newest publication first

1. CVE-2023-40771 DataEase vulnerable to SQL injection

   Published 2023-09-01

   High·CVSS 7.5 EPSS 0.98%

   SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function.

2. CVE-2023-32310 DataEase API interface has IDOR vulnerability

   Published 2023-06-01

   High·CVSS 8.1 EPSS 1.0%

   DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboard or messages or inte...

3. CVE-2022-39312 Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability

   Published 2022-10-25

   Critical·CVSS 9.8 EPSS 2.0%

   Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In b...

4. CVE-2022-34112 Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin

   Published 2022-07-22

   Medium·CVSS 6.5 EPSS 0.61%

   An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator.

5. CVE-2022-34114 SQL Injection found in Dataease

   Published 2022-07-22

   High·CVSS 8.8 EPSS 0.93%

   Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.

6. CVE-2022-34113 Dataease before 1.11.2 allows arbitrary code execution via crafter plugin

   Published 2022-07-22

   Critical·CVSS 9.8 EPSS 1.4%

   An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin.

7. CVE-2022-34115 Dataease v1.11.1 SQL Injection via parameter dataSourceId

   Published 2022-07-22

   Critical·CVSS 9.8 EPSS 1.2%

   DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.