CVE-2024-52295

DataEase has a forged JWT token vulnerability

State: Published
Severity: 9.3 Critical
Published: Nov 13, 2024
Updated: Nov 21, 2024
Reserved: Nov 6, 2024

Description

DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
dataeasedataease	< 2.10.2Affected

References

https://github.com/dataease/dataease/security/advisories/GHSA-45v9-gfcv-xcq6
https://github.com/dataease/dataease/commit/e755248d59543bcd668ace495f293ff735fa82e9

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.