CVE-2022-34113: Arbitrary Code Execution in Dataease Plugin
Summary
CVE-2022-34113: Dataease before 1.11.2 allows arbitrary code execution via crafter plugin. Affects io.dataease:dataease-plugin-common versions < 1.11.2. Fixed in 1.11.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dataease is a software package that provides various functionalities for data management and analysis. It includes a plugin system that allows users to extend its capabilities. The Dataease plugin-common package, specifically versions before 1.11.2, is affected by a critical vulnerability that enables attackers to execute arbitrary code. This vulnerability exists in the component /api/plugin/upload and can be exploited by uploading a crafted plugin. The issue has been addressed in version 1.11.2 with a patch.
Vulnerability Detail
The vulnerability in Dataease plugin-common (versions <= 1.11.1) allows attackers to execute arbitrary code by exploiting the /api/plugin/upload component. By uploading a specially crafted plugin, an attacker can trigger the execution of arbitrary code within the context of the application. This can lead to various consequences, including unauthorized access, data manipulation, and system compromise. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
Minimum fixed version
1.11.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the patched version (1.11.2) as soon as possible to mitigate the risk of exploitation.
Conclusion
The Dataease plugin-common package (versions <= 1.11.1) is vulnerable to arbitrary code execution through the /api/plugin/upload component. To mitigate this risk, it is crucial to update to version 1.11.2 or later, which includes a patch for the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for io.dataease:dataease-plugin-common →
FAQ
This vulnerability allows attackers to execute arbitrary code, potentially leading to unauthorized access, data manipulation, and system compromise.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, a fix is available in version 1.11.2 of the Dataease plugin-common package. It is recommended to update to this version to address the vulnerability.
No, there are no known workarounds for this vulnerability. Updating to the patched version is the only solution.
This vulnerability is rated as critical with a CVSS score of 9.8.
Related vulnerabilities
Recent vulnerabilities recorded for io.dataease:dataease-plugin-common.
