CVE-2023-33963: DataEase data source has deserialization vulnerability
DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEase data sourceto a version that resolves this vulnerability.Fixed in 1.18.7
Event History
Frequently Asked Questions
What is CVE-2023-33963?
CVE-2023-33963 is a deserialization vulnerability in the DataEase datasource, which can be exploited to execute arbitrary code.
What is the severity of CVE-2023-33963?
The severity of CVE-2023-33963 is critical with a score of 9.8.
How can I fix CVE-2023-33963?
To fix CVE-2023-33963, you need to upgrade to DataEase version 1.18.7 or later.
Are there any workarounds for CVE-2023-33963?
There are no known workarounds for CVE-2023-33963 aside from upgrading to DataEase version 1.18.7 or later.
Where can I find more information about CVE-2023-33963?
You can find more information about CVE-2023-33963 in the following references: [link1](https://github.com/dataease/dataease/releases/tag/v1.18.7), [link2](https://github.com/dataease/dataease/security/advisories/GHSA-m26j-gh4m-xh9f).