CVE-2024-31441

HIGH

DataEase < 1.18.19 - Arbitrary File Read via ClickHouse Data Source Connection Parameters

Title source: llm

Description

DataEase is an open source data visualization analysis tool. Due to the lack of restrictions on the connection parameters for the ClickHouse data source, it is possible to exploit certain malicious parameters to achieve arbitrary file reading. The vulnerability has been fixed in v1.18.19.

References (1)

Core 1

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-7wg6-p5wh

Scores

CVSS v3 7.5

EPSS 0.0055

EPSS Percentile 41.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-863

Status published

Products (1)

dataease/dataease < 1.18.19

Published May 14, 2024

Tracked Since Feb 18, 2026