CVE-2024-52295

CRITICAL EPSS 53.0%
Published Nov 13, 20241y ago · Modified Jun 17, 20262w ago
9.3 CVSS 4.0
Critical
Find Similar
Published Nov 13, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2.

CVSS Details

Base Score
9.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
53.0% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-798 Use of Hard-coded Credentials Authentication

Affected Products 1

VendorProductVersionRange
dataeasedataease* <2.10.2

References 2

  • github.com https://github.com/dataease/dataease/commit/e755248d59543bcd668ace495f293ff735fa82e9
    Patch
  • github.com https://github.com/dataease/dataease/security/advisories/GHSA-45v9-gfcv-xcq6
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/dataease/dataease/commit/e755248d59543bcd668ace495f293ff735fa82e9
    Patch