CVE-2023-28437

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-28437
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-28437.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-28437
Aliases
  • GHSA-7j7j-9rw6-3r56
Published
2023-03-24T23:43:15.992Z
Modified
2025-11-29T14:10:25.585117Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed
Details

Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28437.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ]
}
References

Affected packages

Git / github.com/dataease/dataease

Affected ranges

Type
GIT
Repo
https://github.com/dataease/dataease
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ef67a791f47ac53ce3695c46c2a89357b083ce6d

Affected versions

v1.*
v1.0.0
v1.0.0-rc1
v1.0.0-rc2
v1.11.0
v1.11.1
v1.18.0
v1.18.1
v1.18.2
v1.18.3
v1.18.4
v1.2.0
v1.3.0
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-28437.json"