CVE-2024-31441

Published: May 14, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19.

Affected (1)

Products: Dataease: Dataease

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dataease Dataease	Before 1.18.19

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

Timeline

No history available yet.