PT-2023-21865 · Dataease · Dataease

Superxiaoxiong · Publicado 2023-03-28 · Atualizado 2023-04-04 · CVE-2023-28637

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 1.18.5

Description DataEase is an open source data visualization analysis tool where users can modify data, and data sources are expected to sanitize data properly. However, the AWS redshift data source does not provide data sanitization, which may lead to remote code execution.

Recommendations For versions prior to 1.18.5, upgrade to version 1.18.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the AWS redshift data source until the upgrade is applied.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2023-28637

GHSA-8WG2-9GWC-5FX2

Produtos afetados

Dataease

Referências · 5

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-8wg2-9gwc-5fx2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28637.json · Exploit
• https://t.me/cibsecurity/60974 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-28637 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-28637 · Aviso do Fabricante