CVE-2023-28435

2023-03-2421:15:06

Google

osv.dev

dataease

open source

file upload

permissions

vulnerability

fixed

version 1.18.5

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

37.9%

JSON

Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5.

CPENameOperatorVersion
dataeaseeq1.18.0
dataeaseeq1.18.3
dataeaseeq1.9.0
dataeaseeq1.0.0
dataeaseeq1.11.0
dataeaseeq1.2.0
dataeaseeq1.8.0
dataeaseeq1.0.0-rc1
dataeaseeq1.18.4
dataeaseeq1.3.0

Name	Operator	Version
dataease	eq	1.18.0
dataease	eq	1.18.3
dataease	eq	1.9.0
dataease	eq	1.0.0
dataease	eq	1.11.0
dataease	eq	1.2.0
dataease	eq	1.8.0
dataease	eq	1.0.0-rc1
dataease	eq	1.18.4
dataease	eq	1.3.0