CVE-2024-23328: The Dataease datasource exists deserialization and arbitrary file read vulnerability
Vulnerability summary
CVE-2024-23328 is a critical (CVSS 9.1) Deserialization of Untrusted Data vulnerability in dataease. EPSS estimates a 1.21% chance of exploitation in the next 30 days, higher than 68.4% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 01-02-2024PublishedVulnerability first disclosed.
- 28-08-2024Last modifiedVulnerability information updated.
Description
Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is `core/core-backend/src/main/java/io/dataease/datasource/type/Mysql.java.` The blacklist of mysql jdbc attacks can be bypassed and attackers can further exploit it for deserialized execution or reading arbitrary files. This vulnerability is patched in 1.18.15 and 2.3.0.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
1.21%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.21% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundDataease
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Dataease1 product
- dataease< 1.18.15 | ≥ 2.0.0, < 2.3.0
1 vendor · 1 product
References
3 links- github.com/dataease/dataease/security/advisories/GHSA-8x8q-p622-jf25X Refsource CONFIRMExploitVendor Advisory