CVE-2024-31441
Assigner: GitHub_M
Published: 2024-05-10T14:43:23.863Z
State: PUBLISHED
title: Arbitrary File Reading in DataEase
problemTypes: descriptions: cweId: CWE-863
description: CWE-863: Incorrect Authorization
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
affected: vendor: dataease
product: dataease
versions: version: < 1.18.19
status: affected
descriptions: value: DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19.
source: advisory: GHSA-h7hj-7wg6-p5wh
discovery: UNKNOWN