CyberRota Analysis
AI-GeneratedDataEase versions prior to 2.10.23 are vulnerable to stored cross-site scripting (XSS) due to improper validation of uploaded static resources, allowing authenticated users to submit malicious SVG files. This vulnerability can lead to the execution of arbitrary scripts in the context of the victim's browser when they load the affected resource. Organizations using DataEase for data visualization and analysis should prioritize updating to version 2.10.23 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template static resources let authenticated users submit TemplateManageRequest.staticResource through POST /de2api/templateManage/save or DataVisualizationServer.decompression, after which StaticResourceServer.saveFilesToServe and StaticResourceServer.saveSingleFileToServe write Base64-decoded .svg content to /de2api/static-resource/<name>.svg without validating extension, MIME type, decoded bytes, or SVG scriptability, causing stored same-origin cross-site scripting when a victim loads the resource. This issue is fixed in version 2.10.23.