PT-2023-20319 · Dataease · Dataease

Mia0A-Hi · Published 2023-02-28 · Updated 2023-03-07 · CVE-2023-25807

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 1.18.3

Description The issue concerns the DataEase platform, an open source data visualization and analysis tool. When saving a dashboard, an attacker can modify the saved data to store malicious code. This can lead to the execution of malicious code on the server side when a user accesses the dashboard.

Recommendations For versions prior to 1.18.3, update to version 1.18.3 to resolve the issue. As a temporary workaround, consider restricting access to dashboards to minimize the risk of exploitation. Avoid using the platform's dashboard saving feature until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-25807

GHSA-XJ3H-3WMW-J5VF

Affected Products

Dataease

References · 6

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-xj3h-3wmw-j5vf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25807.json · Exploit
• https://github.com/dataease/dataease/commit/cc94fb8e69ddbb37c96d02ec0f0ddcd74273ef49 · Patch
• https://osv.dev/vulnerability/CVE-2023-25807 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25807 · Security Note
• https://t.me/cibsecurity/59102 · Telegram Post