Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-28435 Details

Description

Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/dataease/dataease/issues/4798 CVEExploitIssue TrackingThird Party Advisory
https://github.com/dataease/dataease/security/advisories/GHSA-625h-q3g9-rffc CVEExploitVendor Advisory
https://github.com/dataease/dataease/issues/4798 [email protected]ExploitIssue TrackingThird Party Advisory
https://github.com/dataease/dataease/security/advisories/GHSA-625h-q3g9-rffc [email protected]ExploitVendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')[email protected]

Affected Products

ProductVersions
dataease dataease
< 1.18.5

CPE

  • cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-28435
NVD Published Date:
Mar 24, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2023-28435 Details - Not Deferred