Deserialization of untrusted data

2023-06-0116:15:00

PRIOn knowledge base

www.prio-n.com

dataease

open source

vulnerability

deserialization

datasource

arbitrary code

fix

upgrade

9.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.4%

JSON

DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading.