Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact There is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. 1. send request: 2. After sending the request, the content of the file /etc/alpine-release is successfully read Affected versions: <= 2.10.0 Patches The vulnerability has been fixed in v2.10.1. Workarounds It is recommended to upgrade the version to v2.10.1. References If you have any questions or comments about this advisory: Open an issue in https://github.com/dataease/dataease Email us at wei@fit2cloud.com
Recommended action: Upgrade to 2.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. request message: h2 data source connection string: the content of poc.sql: You can see that the file was created successfully in docker: Affected versions: <= 2.10.0 Patches The vulnerability has been fixed in v2.10.1. Workarounds It is recommended to upgrade the version to v2.10.1. References If you have any questions or comments about this advisory: Open an issue in https://github.com/dataease/dataease Email us at wei@fit2cloud.com
Recommended action: Upgrade to 2.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.