CVE-2023-25807
CVSS V2 None
CVSS V3 None
Description
DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses the dashboard. The vulnerability has been fixed in version 1.18.3.
Overview
- CVE ID
- CVE-2023-25807
- Assigner
- security-advisories@github.com
- Vulnerability Status
- Analyzed
- Published Version
- 2023-02-28T16:15:09
- Last Modified Date
- 2023-03-07T22:57:52
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* | 1 | OR | 1.18.3 |
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/dataease/dataease/commit/cc94fb8e69ddbb37c96d02ec0f0ddcd74273ef49 | Patch |
| https://github.com/dataease/dataease/security/advisories/GHSA-xj3h-3wmw-j5vf | Exploit Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-25807 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25807 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2023-04-17 05:39:59 | Added to TrackCVE | |||
| 2023-04-17 05:40:03 | Weakness Enumeration | new |