GitHub Advisoryadvisory · Maven

GHSA-5469-c5p2-xv5g Dataease before 1.11.2 allows arbitrary code execution via crafter plugin

CRITICAL Published 2022-07-23 Modified 2022-08-10 Official page ↗
Aliases
CVE-2022-34113
Ecosystem
Maven
Packages
io.dataease:dataease-plugin-common
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2022-07-27

Affected packages

• Maven io.dataease:dataease-plugin-common: < 1.11.2 → fixed in 1.11.2

Description

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. Version 1.11.2 contains a patch for the problem.

Related

Alias · CVE (1)

  • CVE-2022-34113 An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References