CVE-2023-1573 DataGear Graph Dataset cross site scripting

What is CVE-2023-1573?

CVE-2023-1573 is a low-severity vulnerability in DataGear, published on 22 Mar 2023.

Official description

A vulnerability was found in DataGear up to 1.11.1 and classified as problematic. This issue affects some unknown processing of the component Graph Dataset Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.12.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-223565 was assigned to this vulnerability.

Weakness: CWE-79

Which versions are affected by CVE-2023-1573?

It affects 1 product.

Products include Datagear Datagear.

How do I fix CVE-2023-1573?

No fix has been published for CVE-2023-1573 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-1573 being exploited?

There is no known exploitation of CVE-2023-1573 in the wild and no public exploit code.

Other vulnerabilities in DataGear

• CVE-2024-37759 Code injection in n/a Critical 9.8
• CVE-2025-65792 Path traversal in n/a Critical 9.1
• CVE-2023-1571 DataGear pagingQueryData sql injection Medium 6.3
• CVE-2023-7299 DataGear resolveSql sql injection Medium 5.3
• CVE-2024-7552 DataGear Data Schema Page ConversionSqlParamValueMapper.java evaluateVariableExpression expression language injection Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-345x-9phv-xfwq.