CVE-2024-31441 HIGH

CVE-2024-31441: Arbitrary File Reading in DataEase

Vendor Dataease
Product dataease
Weakness CWE-863 · Incorrect authorization
Published May 10, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19.

Key dates

02Disclosure timeline

May 10, 2024 CVE published
August 2, 2024 Record updated