VulnerabilityModified
CVE-2023-28435
These vulnerabilities has been fixed in version 1.18.5.
MEDIUM 6.1EPSS 0.46%
Does this matter?
Lower severity and a low EPSS score (0.46%). Track it; it rarely justifies an emergency change on its own.
Description
Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.46% probability · 39th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- dataease/dataease
- Source
- security-advisories@github.com
References
- https://github.com/dataease/dataease/issues/4798Exploit, Issue Tracking, Third Party Advisory
- https://github.com/dataease/dataease/security/advisories/GHSA-625h-q3g9-rffcExploit, Vendor Advisory
- https://github.com/dataease/dataease/issues/4798Exploit, Issue Tracking, Third Party Advisory
- https://github.com/dataease/dataease/security/advisories/GHSA-625h-q3g9-rffcExploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.