CVEvulnerability
CVE-2023-28437
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2023-03-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-89
Description
Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds.
Affected configurations
• dataease dataease (< 1.18.5)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://github.com/dataease/dataease/issues/4795 Exploit, Issue Tracking, Vendor Advisory
- https://github.com/dataease/dataease/releases/tag/v1.18.5 Release Notes
- https://github.com/dataease/dataease/security/advisories/GHSA-7j7j-9rw6-3r56 Exploit, Vendor Advisory
- https://github.com/dataease/dataease/issues/4795 Exploit, Issue Tracking, Vendor Advisory
- https://github.com/dataease/dataease/releases/tag/v1.18.5 Release Notes
- https://github.com/dataease/dataease/security/advisories/GHSA-7j7j-9rw6-3r56 Exploit, Vendor Advisory