PT-2024-24078 · Dataease · Dataease

An5Er · Published 2024-05-10 · Updated 2025-02-12 · CVE-2024-31441

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 1.18.19

Description DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading.

Recommendations For versions prior to 1.18.19, update to version 1.18.19 to resolve the issue. As a temporary workaround, consider restricting access to the ClickHouse data source connection parameters until the update is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-31441

GHSA-H7HJ-7WG6-P5WH

Affected Products

Dataease

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31441.json · Exploit
• https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31441 · Security Note
• https://twitter.com/cracbot/status/1792072791497511041 · Twitter Post
• https://twitter.com/cracbot/status/1791710406123356176 · Twitter Post
• https://t.me/cvenotify/111086 · Telegram Post