CVE-2023-35168: DataEase has a privilege bypass vulnerability
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed information includes md5 hashes of passwords, username, email, and phone number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in v1.18.8
Event History
Frequently Asked Questions
What is CVE-2023-35168?
CVE-2023-35168 is a privilege bypass vulnerability in DataEase, an open source data visualization analysis tool, which allows ordinary users to gain access to the user database and obtain exposed information such as password hashes.
What is the severity of CVE-2023-35168?
The severity of CVE-2023-35168 is medium with a CVSS score of 6.5.
How does CVE-2023-35168 affect DataEase?
CVE-2023-35168 affects versions of DataEase up to and excluding 1.18.8 and allows ordinary users to bypass privileges and access the user database.
What is the CWE ID for CVE-2023-35168?
The CWE ID for CVE-2023-35168 is 732.
How can I fix the CVE-2023-35168 vulnerability?
To fix the CVE-2023-35168 vulnerability, users should update to a version of DataEase that is higher than 1.18.8.