CVE-2024-30269

DataEase has database configuration information exposure vulnerability

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading.

Affected

dataease

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

15.88% chance of exploitation in the next 30 days, 97th percentile

Nuclei

medium · CWE-200

Published

2024-04-08

Updated

2024-08-02

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30269.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52128

Security advisories

• dataease/dataease/security/advisories/GHSA-8gvx-4qvj-6vv5
• dataease/dataease/releases/tag/v2.5.0

References

• CVE Record
• NVD entry