CyberRota Analysis
AI-GeneratedThe vulnerability affects DataEase versions prior to 2.10.24, allowing attackers with a valid share link token to manipulate dataset identifiers and access unauthorized data through the chart data interface. This could lead to significant data exposure risks for organizations using this tool for data visualization and analysis. Users of DataEase should prioritize upgrading to version 2.10.24 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing an attacker with a valid share link token to replace dataset identifiers and retrieve unauthorized data through POST /de2api/chartData/getData. This issue is fixed in version 2.10.24.