1. Home
  2. CVE Database
  3. CVE-2024-55953
HIGH · 8.1

CVE-2024-55953

DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, t...

Vulnerability Description

DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. This vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
DataeaseDataease< 1.18.27

Related Weaknesses (CWE)

CWE-89

References

FAQ

What is CVE-2024-55953?

CVE-2024-55953 is a vulnerability with a CVSS score of 8.1 (HIGH). DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, t...

How severe is CVE-2024-55953?

CVE-2024-55953 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-55953?

Check the references section above for vendor advisories and patch information. Affected products include: Dataease Dataease.