CVE-2024-52295 CRITICAL

CVE-2024-52295: DataEase has a forged JWT token vulnerability

Vendor Dataease
Product dataease
Weakness CWE-798 · Hardcoded credentials
Published November 13, 2024
Last update November 21, 2024
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2.

Key dates

02Disclosure timeline

November 13, 2024 CVE published
November 21, 2024 Record updated