CVE-2023-32310: DataEase API interface IDOR vulnerability in io.dataease:dataease-plugin-common
Summary
CVE-2023-32310: DataEase API interface has IDOR vulnerability. Affects io.dataease:dataease-plugin-common versions < 1.18.7. Fixed in 1.18.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The io.dataease:dataease-plugin-common package is an open-source library used for DataEase API integration. It provides various functionalities for managing dashboards and system messages. However, versions up to 1.18.6 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the API interface. This vulnerability allows an attacker to manipulate request parameters and perform unauthorized actions, such as deleting dashboards and system messages that do not belong to them.
Vulnerability Detail
The IDOR vulnerability in the DataEase API interface has significant impact and potential consequences. Attackers can exploit this vulnerability to delete dashboards and system messages that they should not have access to. For example, by manipulating the request parameters, an attacker can delete another user's dashboard or system message, compromising data integrity and confidentiality. This vulnerability affects versions up to 1.18.6 of the io.dataease:dataease-plugin-common package.
How To Fix
Latest published version: 1.18.16 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.18.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version (1.18.7) to mitigate the risk of unauthorized access and deletion of dashboards and system messages.
Conclusion
The IDOR vulnerability in the DataEase API interface of the io.dataease:dataease-plugin-common package poses a significant risk to the integrity and confidentiality of dashboards and system messages. It is crucial to upgrade to version 1.18.7 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.dataease:dataease-plugin-common →
FAQ
The vulnerability allows attackers to delete dashboards and system messages that they should not have access to, compromising data integrity and confidentiality.
Versions up to 1.18.6 are affected by this vulnerability.
Yes, the vulnerability has been fixed in version 1.18.7 of the io.dataease:dataease-plugin-common package.
No, there are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.dataease:dataease-plugin-common.
