CVE-2023-28435
Summary
| CVE | CVE-2023-28435 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-03-24 21:15:00 UTC |
| Updated | 2023-11-07 04:10:00 UTC |
| Description | Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [Bug] 未授权上传文件导致XSS漏洞 · Issue #4798 · dataease/dataease · GitHub | MISC | github.com | |
| File upload interface does not do permission verification exists XSS vulnerability · Advisory · dataease/dataease · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.