CyberRota Analysis
AI-GeneratedDataEase, an open-source data visualization tool, has a vulnerability in its enterprise token handling that allows forged tokens to bypass signature verification, potentially granting unauthorized access based on manipulated user IDs and object IDs. This flaw could lead to significant security risks, including unauthorized data access or manipulation, particularly for organizations relying on DataEase for sensitive data analysis. Users of versions prior to 2.10.23 should prioritize upgrading to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.