CVE-2024-30269: DataEase has database configuration information exposure vulnerability
DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the /de2api/engine/getEngine;.js path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30269?
CVE-2024-30269 has a high severity due to the potential exposure of database configuration information.
How do I fix CVE-2024-30269?
To fix CVE-2024-30269, upgrade DataEase to version 2.5.0 or higher.
What versions of DataEase are affected by CVE-2024-30269?
DataEase versions prior to 2.5.0 are affected by CVE-2024-30269.
What vulnerability type is CVE-2024-30269?
CVE-2024-30269 is classified as a database configuration information exposure vulnerability.
What happens if I do not address CVE-2024-30269?
If CVE-2024-30269 is not addressed, sensitive database configuration information may be exposed to unauthorized users.