CVE-2024-55953

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-55953
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-55953.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-55953
Aliases
  • GHSA-mrf3-9q84-rcmf
Published
2024-12-18T18:49:21.632Z
Modified
2025-12-01T19:52:24.618424Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability
Details

DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. This vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55953.json"
}
References

Affected packages

Git / github.com/dataease/dataease

Affected ranges

Type
GIT
Repo
https://github.com/dataease/dataease
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8ef98d23903f02ceb8acb47a7d7b0d94f101841a

Affected versions

v1.*

v1.0.0
v1.0.0-rc1
v1.0.0-rc2
v1.11.0
v1.11.1
v1.18.0
v1.18.1
v1.18.10
v1.18.11
v1.18.12
v1.18.13
v1.18.14
v1.18.15
v1.18.16
v1.18.17
v1.18.18
v1.18.19
v1.18.2
v1.18.20
v1.18.21
v1.18.22
v1.18.23
v1.18.24
v1.18.25
v1.18.26
v1.18.3
v1.18.4
v1.18.5
v1.18.6
v1.18.7
v1.18.8
v1.18.9
v1.2.0
v1.3.0
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.8.0
v1.9.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-55953.json"