PT-2023-23720 · Dataease · Dataease

Lujiefsi · Published 2023-06-01 · Updated 2023-06-09 · CVE-2023-32310

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 1.18.7

Description The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboard or messages or interfering with the interface for marking messages read. The vulnerability allows an attacker to delete dashboards or messages of other users by manipulating the request, for example, by replacing the ID of the dashboard or message with the ID of another user's dashboard or message. The interface for marking read messages is also affected.

Recommendations For versions prior to 1.18.7, upgrade to version 1.18.7 to fix the vulnerability. As a temporary workaround, consider restricting access to the API endpoints related to deleting dashboards and system messages, such as "POST /api/share/removePanelShares/" until the issue is resolved. Avoid using the interface to delete dashboards and system messages until the upgrade is applied.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-32310

GHSA-7HV6-GV38-78WJ

Affected Products

Dataease

References · 12

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-7hv6-gv38-78wj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32310.json · Exploit
• https://github.com/dataease/dataease/pull/5342 · Vendor Advisory
• https://github.com/dataease/dataease/commit/72f428e87b5395c03d2f94ef6185fc247ddbc8dc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-32310 · Security Note
• https://osv.dev/vulnerability/GHSA-7hv6-gv38-78wj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32310 · Vendor Advisory
• https://github.com/dataease/dataease/releases/tag/v1.18.7 · Note
• https://github.com/dataease/dataease · Note
• https://t.me/cvenotify/51582 · Telegram Post
• https://t.me/cibsecurity/64864 · Telegram Post
• https://t.me/cvenotify/51583 · Telegram Post