CVE-2023-35168 DataEase has a privilege bypass vulnerability

Medium 6.5 Published 26 Jun 2023 Updated 6 Nov 2024

Ordinary users can bypass privileges to access the user database, exposing sensitive information like password hashes and contact details.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-35168?

CVE-2023-35168 is a medium-severity missing authorization vulnerability in Dataease Dataease, published on 26 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed information includes md5 hashes of passwords, username, email, and phone number. The vulnerability has been fixed in v1.18.8. Users are advised to upgrade. There are no known workarounds for the vulnerability.

Weakness: CWE-732

Which versions are affected by CVE-2023-35168?

It affects 1 product.

Products include Dataease Dataease.

How do I fix CVE-2023-35168?

No fix has been published for CVE-2023-35168 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-35168 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-35168 exists.

All Dataease Dataease vulnerabilities

Sources

Also known as GHSA-c2r2-68p6-73xv.