PT-2023-21865 · Dataease · Dataease

Superxiaoxiong · Published 2023-03-28 · Updated 2023-04-04 · CVE-2023-28637

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 1.18.5

Description DataEase is an open source data visualization analysis tool where users can modify data, and data sources are expected to sanitize data properly. However, the AWS redshift data source does not provide data sanitization, which may lead to remote code execution.

Recommendations For versions prior to 1.18.5, upgrade to version 1.18.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the AWS redshift data source until the upgrade is applied.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-28637

GHSA-8WG2-9GWC-5FX2

Affected Products

Dataease

References · 5

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-8wg2-9gwc-5fx2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28637.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-28637 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28637 · Vendor Advisory
• https://t.me/cibsecurity/60974 · Telegram Post