CVE-2023-35168CWE-732

DataEase has a privilege bypass vulnerability

Medium · published June 26, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
53.2
In the wild
Unconfirmed
What it is

DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed information includes md5 hashes of passwords, username, email, and phone number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for the vulnerability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00714 · 53.2th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2023-06-26T20:11Z
EPSS history
Timeline
  • 26 JUN 20:11Z
    DataEase has a privilege bypass vulnerability
    cvelistv5