CVE-2024-31441: Arbitrary File Reading in DataEase
Published May 10, 2024
·Updated
DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19.
Affected Software
2 affected components
Dataease DataEase<1.18.19
Dataease DataEase<1.18.19
Event History
May 10, 2024
CVE Published
via MITRE·02:43 PM
Data Sourced
via MITRE·02:43 PM
DescriptionSeverityWeakness
May 14, 2024
Data Sourced
via NVD·03:25 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-31441?
The severity of CVE-2024-31441 is high due to the potential for arbitrary file reading on compromised systems.
2
How do I fix CVE-2024-31441?
To fix CVE-2024-31441, update DataEase to version 1.1 or later to mitigate the vulnerability.
3
What systems are affected by CVE-2024-31441?
CVE-2024-31441 affects DataEase versions prior to 1.18.19.
4
Can CVE-2024-31441 lead to data leakage?
Yes, CVE-2024-31441 can lead to data leakage through arbitrary file reading if exploited.
5
Is CVE-2024-31441 exploitable remotely?
Yes, CVE-2024-31441 can be exploited remotely due to inadequate restrictions on connection parameters.