CyberRota Analysis
AI-GeneratedThe vulnerability in DataEase affects the /de2api/datasetData/previewSql endpoint, which lacks proper permission validation, allowing any authenticated user to execute arbitrary SQL statements and access sensitive core data by specifying datasourceId=-1. This could lead to unauthorized data exposure and potential data manipulation. Organizations using versions prior to 2.10.24 should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation annotation, allowing any authenticated user to specify datasourceId=-1, access the built-in engine database, execute arbitrary SQL statements, and read sensitive core data. This issue is fixed in version 2.10.24.