Home > Vulnerability Database > CVE-2024-52295

Mend.io Vulnerability Database

CVE-2024-52295

Good to know:

Date: November 13, 2024

DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2.

Language: Java

Severity Score

0.0

Related Resources (4)

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-52295

Url: https://github.com/dataease/dataease/commit/e755248d59543bcd668ace495f293ff735fa82e9

Url: https://github.com/dataease/dataease/security/advisories/GHSA-45v9-gfcv-xcq6

Url: https://www.mend.io/vulnerability-database/CVE-2024-52295

Weakness Type (CWE)

Use of Hard-coded Credentials

CWE-798

Top Fix

Upgrade Version

Upgrade to version v2.10.2

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE