CVE-2024-52295: DataEase has a forged JWT token vulnerability

Q: What is the severity of CVE-2024-52295?

CVE-2024-52295 is considered a high severity vulnerability due to its ability to allow attackers to forge JWTs and take over services.

Q: How do I fix CVE-2024-52295?

To fix CVE-2024-52295, upgrade DataEase to version 2.10.2 or later where the vulnerability is patched.

Q: What are the potential consequences of CVE-2024-52295?

Exploiting CVE-2024-52295 could lead to unauthorized access and control over services using DataEase.

Q: Which versions of DataEase are affected by CVE-2024-52295?

CVE-2024-52295 affects all versions of DataEase prior to 2.10.2.

Q: Is there a workaround for CVE-2024-52295?

There are no known workarounds for CVE-2024-52295; the recommended action is to upgrade to the fixed version.

Published Nov 13, 2024

Updated

DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2.

Affected Software

2 affected components

Dataease DataEase<2.10.2

Remediation

Patch Available

https://github.com/dataease/dataease/commit/e755248d59543bcd668ace495f293ff735fa82e9

Event History

Nov 13, 2024

CVE Published

via MITRE·03:49 PM

Data Sourced

via MITRE·03:49 PM

DescriptionWeakness

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Oct 23, 57112

Event

via NVD·10:47 AM

Frequently Asked Questions

What is the severity of CVE-2024-52295?

CVE-2024-52295 is considered a high severity vulnerability due to its ability to allow attackers to forge JWTs and take over services.

How do I fix CVE-2024-52295?