Today > | 3 Medium vulnerabilities   -   You can now download lists of IOCs here!

CVE-2024-47073

Nov. 21, 2024, 5:15 p.m.

Tags

security-advisories@github.com
CWE-347
2024-11-07
CVE-2024-47073

Product(s) Impacted

DataEase

  • 2.10.2

Description

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The vulnerability has been fixed in v2.10.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Weaknesses

CWE-347
Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

CWE ID: 347

Date

Published: Nov. 7, 2024, 6:15 p.m.

Last Modified: Nov. 21, 2024, 5:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

References

https://github.com/ security-advisories@github.com