GitHub Advisoryadvisory · Maven

GHSA-c2pj-rr68-pw94 Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin

MEDIUM Published 2022-07-23 Modified 2022-08-10 Official page ↗
Aliases
CVE-2022-34112
Ecosystem
Maven
Packages
io.dataease:dataease-plugin-common
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-732
Reviewed
2022-07-27

Affected packages

• Maven io.dataease:dataease-plugin-common: < 1.11.2 → fixed in 1.11.2

Description

An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator. Version 1.11.2 contains a patch for this issue.

Related

Alias · CVE (1)

  • CVE-2022-34112 An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References