PT-2023-20319 · Dataease · Dataease

Mia0A-Hi · Publicado 2023-02-28 · Atualizado 2023-03-07 · CVE-2023-25807

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 1.18.3

Description The issue concerns the DataEase platform, an open source data visualization and analysis tool. When saving a dashboard, an attacker can modify the saved data to store malicious code. This can lead to the execution of malicious code on the server side when a user accesses the dashboard.

Recommendations For versions prior to 1.18.3, update to version 1.18.3 to resolve the issue. As a temporary workaround, consider restricting access to dashboards to minimize the risk of exploitation. Avoid using the platform's dashboard saving feature until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-25807

GHSA-XJ3H-3WMW-J5VF

Produtos afetados

Dataease

Referências · 6

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-xj3h-3wmw-j5vf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25807.json · Exploit
• https://github.com/dataease/dataease/commit/cc94fb8e69ddbb37c96d02ec0f0ddcd74273ef49 · Correção
• https://t.me/cibsecurity/59102 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25807 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25807 · Nota de Segurança