CVE-2022-34112: Arbitrary Uninstallation of Dataease Plugin
Summary
CVE-2022-34112: Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin. Affects io.dataease:dataease-plugin-common versions < 1.11.2. Fixed in 1.11.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dataease is a software package that provides various functionalities for data management and analysis. The affected package, io.dataease:dataease-plugin-common, is a Maven package commonly used in Dataease installations. It is responsible for handling plugin-related operations within the Dataease framework.
Vulnerability Detail
An access control issue in Dataease v1.11.1 allows attackers to uninstall plugins arbitrarily, bypassing the normal administrator privileges. This vulnerability exists in the component /api/plugin/uninstall. By exploiting this issue, unauthorized users can remove plugins, potentially disrupting the functionality and security of the Dataease system. The vulnerability has been assigned a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.11.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading to Dataease v1.11.2 or a later version.
Conclusion
The access control issue in Dataease v1.11.1 allows unauthorized users to uninstall plugins arbitrarily, posing a risk to the functionality and security of the system. It is crucial to upgrade to Dataease v1.11.2 or a later version to fix this vulnerability. No known workarounds exist, and it is recommended to use the Vulert Playground to check if your Dataease installation is affected. For additional support, contact DevNack.com.
See every vulnerability recorded for io.dataease:dataease-plugin-common →
FAQ
This vulnerability allows attackers to uninstall plugins arbitrarily, which can disrupt the functionality and security of the Dataease system.
Dataease installations using versions 1.11.1 and earlier of the io.dataease:dataease-plugin-common package are affected by this vulnerability.
No, there is no known workaround. It is crucial to upgrade to Dataease v1.11.2 or a later version to fix the vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities, including this one.
For further support on vulnerability remediation and securing your Dataease installation, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.dataease:dataease-plugin-common.
