CVE-2023-40183 DataEase has a vulnerability to obtain user cookies

What is CVE-2023-40183?

CVE-2023-40183 is a high-severity vulnerability in Dataease Dataease, published on 21 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

DataEase is an open source data visualization and analysis tool. Prior to version 1.18.11, DataEase has a vulnerability that allows an attacker to to obtain user cookies. The program only uses the `ImageIO.read()` method to determine whether the file is an image file or not. There is no whitelisting restriction on file suffixes. This allows the attacker to synthesize the attack code into an image for uploading and change the file extension to html. The attacker may steal user cookies by accessing links. The vulnerability has been fixed in v1.18.11. There are no known workarounds.

Weakness: CWE-434

Which versions are affected by CVE-2023-40183?

It affects 1 product.

Products include Dataease Dataease.

How do I fix CVE-2023-40183?

No fix has been published for CVE-2023-40183 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-40183 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-40183 exists.

Other vulnerabilities in Dataease Dataease

• CVE-2024-57707 Code injection in n/a Critical 9.8
• CVE-2024-46997 DataEase's H2 datasource has a remote command execution risk Critical 9.8
• CVE-2023-33963 DataEase data source has deserialization vulnerability Critical 9.8
• CVE-2023-28437 SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed Critical 9.8
• CVE-2022-39312 Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability Critical 9.8

All Dataease Dataease vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w2r4-2r4w-fjxv.