CVE-2024-55953: Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability
DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. This vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55953?
The severity of CVE-2024-55953 is considered high due to the potential for unauthorized access to sensitive data through arbitrary file deserialization.
How do I fix CVE-2024-55953?
To fix CVE-2024-55953, update DataEase to version 1.18.27 or later.
Who is affected by CVE-2024-55953?
Authenticated users of DataEase versions below 1.18.27 are affected by CVE-2024-55953.
What types of attacks can exploit CVE-2024-55953?
CVE-2024-55953 can be exploited through crafted JDBC connection strings that allow deserialization of arbitrary files.
Is there a patch available for CVE-2024-55953?
Yes, a patch for CVE-2024-55953 is included in DataEase version 1.18.27 and later.