CVE-2024-52295

CRITICAL

9.8

Description

DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published11/13/2024

Last Modified2/20/2025

Sourcenvd

Honeypot Sightings0

Affected Products

dataease:dataease

Weaknesses (CWE)

CWE-798

References

https://github.com/dataease/dataease/commit/e755248d59543bcd668ace495f293ff735fa82e9(security-advisories@github.com)

https://github.com/dataease/dataease/security/advisories/GHSA-45v9-gfcv-xcq6(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.