CVE-2023-28437: SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed
Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-28437?
CVE-2023-28437 is a vulnerability in Dataease, an open-source data visualization and analysis tool, that allows SQL injection due to missing entries in the blacklist for SQL injection protection.
What is the severity of CVE-2023-28437?
The severity of CVE-2023-28437 is critical with a severity score of 9.8.
How does CVE-2023-28437 affect Dataease?
CVE-2023-28437 affects Dataease, version up to exclusive 1.18.5, by exposing it to SQL injection attacks due to the missing entries in the blacklist for SQL injection protection.
Is there a fix for CVE-2023-28437?
Yes, CVE-2023-28437 has been fixed in version 1.18.5 of Dataease.
Are there any known workarounds for CVE-2023-28437?
No, there are no known workarounds for CVE-2023-28437.