CVE-2024-46985

DataEase has an XXE vulnerability

State: Published
Severity: 7.5 High
Published: Sep 23, 2024
Updated: Sep 23, 2024
Reserved: Sep 16, 2024

Description

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference

Affected Products

Product	Versions
dataeasedataease	< 2.10.1Affected

References

https://github.com/dataease/dataease/security/advisories/GHSA-4m9p-7xg6-f4mm

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.