CVE-2024-47073

CRITICAL NUCLEI

DataEase < 2.10.2 - Improper Verification of Cryptographic Signature for JWT Tokens

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-47073 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The vulnerability has been fixed in v2.10.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Nuclei Templates (1)

DataEase v2.10.2 - JWT Signature Verification Bypass
CRITICALVERIFIEDby iamnoooob,pdresearch
Shodan: http.html:"dataease"
FOFA: body="dataease"

References (1)

Core 1
Core References

Scores

CVSS v3 9.1
EPSS 0.0122
EPSS Percentile 64.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-347
Status published
Products (1)
dataease/dataease < 2.10.2
Published Nov 07, 2024
Tracked Since Feb 18, 2026