Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-34112 · ADVISORY
• dataease/dataease · WEB
• dataease/dataease commit 5f611d3 · WEB
• dataease/dataease · PACKAGE
• dataease/dataease release v1.11.2 · WEB

io.dataease:dataease-plugin-common のその他の脆弱性

• CVE-2023-40771高 7.5SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of th…
• CVE-2023-32310高 8.1DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages …
• CVE-2022-39312緊急 9.8Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the …
• CVE-2022-34115緊急 9.8DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId.
• CVE-2022-34114高 8.8Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId.