Lucene search

GoogleOSV:CVE-2023-25807

HistoryFeb 28, 2023 - 4:15 p.m.

CVE-2023-25807

2023-02-2816:15:09

Google

osv.dev

dataease

dashboard

vulnerability

fixed

version 1.18.3

malicious code

server-side

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.4%

JSON

DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses the dashboard. The vulnerability has been fixed in version 1.18.3.

CPENameOperatorVersion
dataeaseeq1.5.2
dataeaseeq1.5.1
dataeaseeq1.3.0
dataeaseeq1.0.0-rc2
dataeaseeq1.9.0
dataeaseeq1.2.0
dataeaseeq1.5.0
dataeaseeq1.0.0
dataeaseeq1.11.0
dataeaseeq1.11.1

Name	Operator	Version
dataease	eq	1.5.2
dataease	eq	1.5.1
dataease	eq	1.3.0
dataease	eq	1.0.0-rc2
dataease	eq	1.9.0
dataease	eq	1.2.0
dataease	eq	1.5.0
dataease	eq	1.0.0
dataease	eq	1.11.0
dataease	eq	1.11.1

Rows per page:

1-10 of 131

References

github.com/dataease/dataease/commit/cc94fb8e69ddbb37c96d02ec0f0ddcd74273ef49

github.com/dataease/dataease/security/advisories/GHSA-xj3h-3wmw-j5vf

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

7 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.4%

JSON

Related for OSV:CVE-2023-25807