PT-2024-27732 · Datagear · Datagear

Crumbledwall · Published 2024-06-24 · Updated 2025-06-13 · CVE-2024-37759

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataGear versions 5.0.0 and earlier

Description A SpEL (Spring Expression Language) expression injection issue was found in the Data Viewing interface. This allows for potential malicious activity via the injection of expressions.

Recommendations For versions 5.0.0 and earlier, consider restricting access to the Data Viewing interface until a fix is available. As a temporary workaround, disabling the use of SpEL expressions in this interface may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2024-37759

Affected Products

Datagear

References · 7

• 🔥 https://github.com/datageartech/datagear/issues/32 · Exploit
• 🔥 https://github.com/crumbledwall/CVE-2024-37759_PoC · Exploit
• https://osv.dev/vulnerability/CVE-2024-37759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37759 · Security Note
• https://t.me/cvenotify/84338 · Telegram Post
• https://t.me/cvenotify/125641 · Telegram Post
• https://t.me/cvenotify/84251 · Telegram Post