CVE-2024-31441

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh	Exploit Vendor Advisory
https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*

History

12 Feb 2025, 17:49

Type	Values Removed	Values Added
CPE		cpe:2.3:a:dataease:dataease::::::::
References	~~() https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh -~~	() https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh - Exploit, Vendor Advisory
First Time		Dataease Dataease dataease

Information

Published : 2024-05-14 15:25

Updated : 2025-02-12 17:49

NVD link : CVE-2024-31441

Mitre link : CVE-2024-31441

CVE.ORG link : CVE-2024-31441

JSON object : View

Products Affected

dataease

dataease

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2024-31441", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-05-14T15:25:18.967", "references": [{"url": "https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19."}, {"lang": "es", "value": "DataEase es una herramienta de an\u00e1lisis de visualizaci\u00f3n de datos de c\u00f3digo abierto. Debido a la falta de restricciones en los par\u00e1metros de conexi\u00f3n para la fuente de datos de ClickHouse, es posible explotar ciertos par\u00e1metros maliciosos para lograr una lectura de archivos arbitraria. La vulnerabilidad se ha solucionado en v1.18.19."}], "lastModified": "2025-02-12T17:49:35.443", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06697CDB-18F5-48BB-A3B2-9CE2FBCC1094", "versionEndExcluding": "1.18.19"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}