CVE-2024-30269 DataEase has database configuration information exposure vulnerability
An unauthenticated attacker can access a specific API endpoint to retrieve sensitive database configuration details from DataEase.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-30269?
CVE-2024-30269 is a medium-severity vulnerability in Dataease Dataease, published on 8 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading.
Weakness: CWE-200
Which versions are affected by CVE-2024-30269?
It affects 1 product.
Products include Dataease Dataease.
How do I fix CVE-2024-30269?
No fix has been published for CVE-2024-30269 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-30269 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-30269 exists.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Other vulnerabilities in Dataease Dataease
- CVE-2024-57707 Code injection in n/a
- CVE-2024-46997 DataEase's H2 datasource has a remote command execution risk
- CVE-2023-33963 DataEase data source has deserialization vulnerability
- CVE-2023-28437 SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed
- CVE-2022-39312 Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability
Sources
Also known as GHSA-8gvx-4qvj-6vv5.