CVE-2024-30269
MEDIUM EXPLOITED NUCLEIdataease < 2.5.0 - Unauthenticated Exposure of Sensitive Database Configuration via /de2api/engine/getEngine;.js
Title source: llmExploitation Summary
CVE-2024-30269 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including ByteHunter. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit targets CVE-2024-30269 in DataEase 2.4.0-2.5.0, exposing database configuration information including credentials via an unauthenticated API endpoint. It sends a GET request to /de2api/engine/getEngine;.js and parses the JSON response for sensitive data.
Description
DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading.
Exploits (1)
This exploit targets CVE-2024-30269 in DataEase 2.4.0-2.5.0, exposing database configuration information including credentials via an unauthenticated API endpoint. It sends a GET request to /de2api/engine/getEngine;.js and parses the JSON response for sensitive data.
Nuclei Templates (1)
http.html:"dataease"
body="dataease"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N