Lucene search

GitHub_MCVELIST:CVE-2023-25807

HistoryFeb 28, 2023 - 3:05 p.m.

CVE-2023-25807 DataEase dashboard has a stored XSS vulnerability

2023-02-2815:05:33

CWE-79

GitHub_M

www.cve.org

dataease

dashboard vulnerability

stored xss

version 1.18.3 fix

data visualization

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

26.4%

JSON

DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses the dashboard. The vulnerability has been fixed in version 1.18.3.

CNA Affected

[
  {
    "vendor": "dataease",
    "product": "dataease",
    "versions": [
      {
        "version": "< 1.18.3",
        "status": "affected"
      }
    ]
  }
]

References

github.com/dataease/dataease/commit/cc94fb8e69ddbb37c96d02ec0f0ddcd74273ef49

github.com/dataease/dataease/security/advisories/GHSA-xj3h-3wmw-j5vf

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

26.4%

JSON

Related for CVELIST:CVE-2023-25807