Lucene search

[email protected]CVE-2024-31441

HistoryMay 14, 2024 - 3:25 p.m.

CVE-2024-31441

2024-05-1415:25:18

CWE-863

[email protected]

web.nvd.nist.gov

dataease

open source

arbitrary file reading

clickhouse

vulnerability

fixed

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19.

Affected configurations

Vulners

Node

dataeasedataeaseRange<1.18.19

VendorProductVersionCPE
dataeasedataease*cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dataease	dataease	*	cpe:2.3:a:dataease:dataease::::::::

CNA Affected

[
  {
    "vendor": "dataease",
    "product": "dataease",
    "versions": [
      {
        "version": "< 1.18.19",
        "status": "affected"
      }
    ]
  }
]

References

github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for CVE-2024-31441

nvd1 vulnrichment1 cvelist1