CVE-2023-37258

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published Jul 25, 2023

Updated: Aug 1, 2023

CWE ID 89

Summary

CVE-2023-37258 is a SQL injection vulnerability affecting the open-source data visualization analysis tool, DataEase. Prior to version 1.18.9, DataEase was susceptible to SQL injection attacks that bypassed blacklists. This issue posed a significant risk as it allowed malicious users to execute unauthorized SQL commands. Fortunately, the vulnerability has been addressed and patched in version 1.18.9. No known workarounds exist for older versions, making it crucial for users to upgrade to the latest release to protect against potential attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Data Ease

Affected Vendors

Dataease

Advisories, Assessments, and Mitigations

https://app.recordedfuture.com/live/sc/entity/r1MEA7
https://www.cve.org/CVERecord?id=CVE-2023-37258
https://nvd.nist.gov/vuln/detail/CVE-2023-37258

Back to Vulnerability Database