CVE-2023-28437

Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_MCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
VendorProductVersion
dataeasedataease
𝑥
< 1.18.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/dataease/dataease/issues/4795
https://github.com/dataease/dataease/releases/tag/v1.18.5
https://github.com/dataease/dataease/security/advisories/GHSA-7j7j-9rw6-3r56
https://github.com/dataease/dataease/issues/4795
https://github.com/dataease/dataease/releases/tag/v1.18.5
https://github.com/dataease/dataease/security/advisories/GHSA-7j7j-9rw6-3r56