CVE-2024-23328: The Dataease datasource exists deserialization and arbitrary file read vulnerability
Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java. The blacklist of mysql jdbc attacks can be bypassed and attackers can further exploit it for deserialized execution or reading arbitrary files. This vulnerability is patched in 1.18.15 and 2.3.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23328?
CVE-2024-23328 is considered a critical vulnerability due to its ability to allow execution of arbitrary code through deserialization.
How do I fix CVE-2024-23328?
To mitigate CVE-2024-23328, update Dataease to version 2.3.0 or later, or ensure you are using versions lower than 1.18.15.
What types of systems are affected by CVE-2024-23328?
CVE-2024-23328 affects Dataease versions up to 1.18.15 and versions between 2.0.0 and 2.3.0.
What can attackers achieve by exploiting CVE-2024-23328?
Attackers exploiting CVE-2024-23328 can execute arbitrary code on the affected system, leading to potential data breaches or system compromise.
Is CVE-2024-23328 publicly known?
Yes, CVE-2024-23328 is a publicly disclosed vulnerability that has been documented in several cybersecurity advisories.