CVE-2024-47073

Dataease arbitrary interface access vulnerability

State: Published
Severity: 9.3 Critical
Published: Nov 7, 2024
Updated: Nov 21, 2024
Reserved: Sep 17, 2024

Description

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The vulnerability has been fixed in v2.10.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-347 Improper Verification of Cryptographic Signature

Affected Products

Product	Versions
dataeasedataease	< 2.10.2Affected

References

https://github.com/dataease/dataease/security/advisories/GHSA-5jr4-wrm2-xj36

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.