CVE-2024-55953

CVSS V2 None CVSS V3 None

Description

DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. This vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Overview

CVE ID
CVE-2024-55953

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-12-18T18:49:21.632Z

Last Modified Date
2024-12-18T19:16:27.090Z

Weakness Enumerations

CWE	URL
CWE-89	http://cwe.mitre.org/data/definitions/89.html

References

Reference URL	Reference Tags
https://github.com/dataease/dataease/security/advisories/GHSA-mrf3-9q84-rcmf	x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/0db4872a52eccf6e83dd9359aa05db52dd580ec1	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-55953
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55953

History

Created	Old Value	New Value	Data Type	Notes
2024-12-19 13:19:11				Added to TrackCVE