CVE-2024-23328: The Dataease datasource exists deserialization and arbitrary file read vulnerability
First published: Thu Feb 01 2024(Updated: )
Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is `core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java.` The blacklist of mysql jdbc attacks can be bypassed and attackers can further exploit it for deserialized execution or reading arbitrary files. This vulnerability is patched in 1.18.15 and 2.3.0.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dataease | <1.18.15 | |
| Dataease | >=2.0.0<2.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-23328?
CVE-2024-23328 is considered a critical vulnerability due to its ability to allow execution of arbitrary code through deserialization.
How do I fix CVE-2024-23328?
To mitigate CVE-2024-23328, update Dataease to version 2.3.0 or later, or ensure you are using versions lower than 1.18.15.
What types of systems are affected by CVE-2024-23328?
CVE-2024-23328 affects Dataease versions up to 1.18.15 and versions between 2.0.0 and 2.3.0.
What can attackers achieve by exploiting CVE-2024-23328?
Attackers exploiting CVE-2024-23328 can execute arbitrary code on the affected system, leading to potential data breaches or system compromise.
Is CVE-2024-23328 publicly known?
Yes, CVE-2024-23328 is a publicly disclosed vulnerability that has been documented in several cybersecurity advisories.
- agent/weakness
- agent/references
- agent/title
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/dataease
- canonical/dataease
- version/dataease/2.0.0