CVE-2023-2042 DataGear JDBC Server deserialization
Remote attackers can exploit a deserialization flaw in the DataGear JDBC Server Handler to potentially execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-2042?
CVE-2023-2042 is a medium-severity unsafe deserialization vulnerability in DataGear, published on 14 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability, which was classified as problematic, has been found in DataGear up to 4.7.0/5.1.0. Affected by this issue is some unknown functionality of the component JDBC Server Handler. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-502
Which versions are affected by CVE-2023-2042?
It affects 1 product.
Products include Datagear Datagear.
How do I fix CVE-2023-2042?
No fix has been published for CVE-2023-2042 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-2042 being exploited?
There is no known exploitation of CVE-2023-2042 in the wild and no public exploit code.
Other vulnerabilities in DataGear
- CVE-2024-37759 Code injection in n/a
- CVE-2025-65792 Path traversal in n/a
- CVE-2023-1571 DataGear pagingQueryData sql injection
- CVE-2023-7299 DataGear resolveSql sql injection
- CVE-2024-7552 DataGear Data Schema Page ConversionSqlParamValueMapper.java evaluateVariableExpression expression language injection
Sources
Also known as GHSA-94rv-4qh8-r994.