CVE-2024-55953: Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability
First published: Wed Dec 18 2024(Updated: )
DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. This vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dataease | <1.18.27 | |
| Dataease | <1.18.27 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-55953?
The severity of CVE-2024-55953 is considered high due to the potential for unauthorized access to sensitive data through arbitrary file deserialization.
How do I fix CVE-2024-55953?
To fix CVE-2024-55953, update DataEase to version 1.18.27 or later.
Who is affected by CVE-2024-55953?
Authenticated users of DataEase versions below 1.18.27 are affected by CVE-2024-55953.
What types of attacks can exploit CVE-2024-55953?
CVE-2024-55953 can be exploited through crafted JDBC connection strings that allow deserialization of arbitrary files.
Is there a patch available for CVE-2024-55953?
Yes, a patch for CVE-2024-55953 is included in DataEase version 1.18.27 and later.
- agent/weakness
- agent/title
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/guess-ai
- agent/softwarecombine
- vendor/dataease
- canonical/dataease