CVE-2024-46985CWE-611

DataEase has an XXE vulnerability

High · published September 23, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
51.2
In the wild
Unconfirmed
What it is

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00666 · 51.2th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2024-09-23T15:12Z
EPSS history
Timeline
  • 23 SEP 15:12Z
    DataEase has an XXE vulnerability
    cvelistv5