CVE-2023-40183

Katalog CVE

CVSS 5.3 · Medium EPSS 0,78%

Kerentanan Unrestricted Upload of File with Dangerous Type pada dataease. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the `ImageIO.read()` method to determine whether the file is an image file or not. There is no whitelisting restriction on file suffixes. This allows the attacker to synthesize the attack code into an image for uploading and change the file extension to html. The attacker may steal user cookies by accessing links. The vulnerability has been fixed in v1.18.11. There are no known workarounds.

Rincian

Terbit di NVD

21 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dataease/dataease/commit/826513053146721a2b3e09a9c9d3ea41f8f10569 patch
• https://github.com/dataease/dataease/security/advisories/GHSA-w2r4-2r4w-fjxv exploit
• https://github.com/dataease/dataease/releases/tag/v1.18.11 release notes