CVE-2022-39312 Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability

Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In...

CVE-2022-39312 Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability

Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In...

CVE-2022-39312

Dataease CVE-2022-39312 describes a deserialization vulnerability in the Mysql data source JDBC connection: MysqlConfiguration does not filter JDBC URL parameters, so an attacker can append parameters to connect to a malicious MySQL server and trigger a MySQL JDBC deserialization, potentially exe...

io.dataease:dataease-plugin-datasource (>=1.10.0 <=1.15.0), io.dataease:dataease-plugin-interface (>=1.0 <=1.15.0) +1 more potentially affected by CVE-2022-39312 via io.dataease:dataease-plugin-common (>=1.0 <=1.15.0)

io.dataease:dataease-plugin-common MAVEN version =1.0, =1.10.0, =1.0, =1.10.0, =1.15.0 Source cves: CVE-2022-39312 Source advisory: OSV:GHSA-Q4QQ-JHJV-7RH2...