CVE-2023-40183: DataEase has a vulnerability to obtain user cookies
DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the ImageIO.read() method to determine whether the file is an image file or not. There is no whitelisting restriction on file suffixes. This allows the attacker to synthesize the attack code into an image for uploading and change the file extension to html. The attacker may steal user cookies by accessing links. The vulnerability has been fixed in v1.18.11. There are no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-40183?
CVE-2023-40183 is a vulnerability in DataEase, an open source data visualization and analysis tool, that allows an attacker to obtain user cookies.
How severe is CVE-2023-40183?
CVE-2023-40183 has a severity score of 5.3, which is considered high.
How does CVE-2023-40183 work?
CVE-2023-40183 occurs when DataEase uses the `ImageIO.read()` method to determine whether a file is an image file or not, without proper whitelisting.
Which version of DataEase is affected by CVE-2023-40183?
DataEase versions before 1.18.11 are affected by CVE-2023-40183.
Is there a fix for CVE-2023-40183?
Yes, upgrading to DataEase version 1.18.11 or later fixes CVE-2023-40183.