CVE-2023-40772: Medium severity DataEase vulnerability

Q: What level of access does an attacker need?

The attacker must have low-level privileges. No user interaction is required, and the attack can be performed remotely using a crafted request.

Q: Which DataEase versions should be remediated?

DataEase versions before 1.18.10 are affected. Upgrade to 1.18.10 or later if possible.

Published Sep 14, 2026

Updated

A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.

Affected Software

1 affected component

DataEase<1.18.10

Event History

Sep 14, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The attacker must have low-level privileges. No user interaction is required, and the attack can be performed remotely using a crafted request.

Which DataEase versions should be remediated?

DataEase versions before 1.18.10 are affected. Upgrade to 1.18.10 or later if possible.