CVE-2023-32310CWE-639

DataEase API interface has IDOR vulnerability

High · published June 1, 2023

CVSS v3.1
8.1
EPSS
1%
Percentile
62.9
In the wild
Unconfirmed
What it is

DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboard or messages or interfering with the interface for marking messages read. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01014 · 62.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2023-06-01T15:05Z
EPSS history
Timeline
  • 01 JUN 15:05Z
    DataEase API interface has IDOR vulnerability
    cvelistv5