Vulnerability Details CVE-2023-37258
DataEase is an open source data visualization analysis tool. Prior to version 1.18.9, DataEase has a SQL injection vulnerability that can bypass blacklists. The vulnerability has been fixed in v1.18.9. There are no known workarounds.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 41.2%
CVSS Severity
CVSS v3 Score 8.8
References
- https://github.com/dataease/dataease/blob/dev/backend/src/main/java/io/dataease/controller/panel/AppLogController.java#L41
- https://github.com/dataease/dataease/blob/dev/backend/src/main/java/io/dataease/ext/ExtDataSourceMapper.java
- https://github.com/dataease/dataease/security/advisories/GHSA-r39x-fcc6-47g4
- https://github.com/dataease/dataease/blob/dev/backend/src/main/java/io/dataease/controller/panel/AppLogController.java#L41
- https://github.com/dataease/dataease/blob/dev/backend/src/main/java/io/dataease/ext/ExtDataSourceMapper.java
- https://github.com/dataease/dataease/security/advisories/GHSA-r39x-fcc6-47g4
Products affected by CVE-2023-37258
-
cpe:2.3:a:dataease:dataease:-
-
cpe:2.3:a:dataease:dataease:1.0.0
-
cpe:2.3:a:dataease:dataease:1.0.1
-
cpe:2.3:a:dataease:dataease:1.0.2
-
cpe:2.3:a:dataease:dataease:1.1.0
-
cpe:2.3:a:dataease:dataease:1.1.1
-
cpe:2.3:a:dataease:dataease:1.10.0
-
cpe:2.3:a:dataease:dataease:1.11.0
-
cpe:2.3:a:dataease:dataease:1.11.1
-
cpe:2.3:a:dataease:dataease:1.11.2
-
cpe:2.3:a:dataease:dataease:1.11.3
-
cpe:2.3:a:dataease:dataease:1.12.0
-
cpe:2.3:a:dataease:dataease:1.13.0
-
cpe:2.3:a:dataease:dataease:1.13.1
-
cpe:2.3:a:dataease:dataease:1.14.0
-
cpe:2.3:a:dataease:dataease:1.15.0
-
cpe:2.3:a:dataease:dataease:1.15.1
-
cpe:2.3:a:dataease:dataease:1.15.2
-
cpe:2.3:a:dataease:dataease:1.15.3
-
cpe:2.3:a:dataease:dataease:1.15.4
-
cpe:2.3:a:dataease:dataease:1.16.0
-
cpe:2.3:a:dataease:dataease:1.16.1
-
cpe:2.3:a:dataease:dataease:1.17.0
-
cpe:2.3:a:dataease:dataease:1.17.1
-
cpe:2.3:a:dataease:dataease:1.18.0
-
cpe:2.3:a:dataease:dataease:1.18.1
-
cpe:2.3:a:dataease:dataease:1.18.2
-
cpe:2.3:a:dataease:dataease:1.18.3
-
cpe:2.3:a:dataease:dataease:1.18.4
-
cpe:2.3:a:dataease:dataease:1.18.5
-
cpe:2.3:a:dataease:dataease:1.18.6
-
cpe:2.3:a:dataease:dataease:1.18.7
-
cpe:2.3:a:dataease:dataease:1.18.8
-
cpe:2.3:a:dataease:dataease:1.2.0
-
cpe:2.3:a:dataease:dataease:1.2.1
-
cpe:2.3:a:dataease:dataease:1.2.2
-
cpe:2.3:a:dataease:dataease:1.2.3
-
cpe:2.3:a:dataease:dataease:1.3.0
-
cpe:2.3:a:dataease:dataease:1.4.0
-
cpe:2.3:a:dataease:dataease:1.4.1
-
cpe:2.3:a:dataease:dataease:1.5.0
-
cpe:2.3:a:dataease:dataease:1.5.1
-
cpe:2.3:a:dataease:dataease:1.5.2
-
cpe:2.3:a:dataease:dataease:1.6.0
-
cpe:2.3:a:dataease:dataease:1.6.1
-
cpe:2.3:a:dataease:dataease:1.6.2
-
cpe:2.3:a:dataease:dataease:1.7.0
-
cpe:2.3:a:dataease:dataease:1.8.0
-
cpe:2.3:a:dataease:dataease:1.9.0
-
cpe:2.3:a:dataease:dataease:1.9.1