gsd-2022-39312
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue.
Aliases
Aliases
CVE-2022-39312


To clipboard 

{
  "GSD": {
    "alias": "CVE-2022-39312",
    "description": "Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue.",
    "id": "GSD-2022-39312"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-39312"
      ],
      "details": "Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue.",
      "id": "GSD-2022-39312",
      "modified": "2023-12-13T01:19:20.877368Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-39312",
        "STATE": "PUBLIC",
        "TITLE": "Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "dataease",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 1.15.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "dataease"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-20: Improper Input Validation"
              }
            ]
          },
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-502: Deserialization of Untrusted Data"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/dataease/dataease/security/advisories/GHSA-q4qq-jhjv-7rh2",
            "refsource": "CONFIRM",
            "url": "https://github.com/dataease/dataease/security/advisories/GHSA-q4qq-jhjv-7rh2"
          },
          {
            "name": "https://github.com/dataease/dataease/pull/3328",
            "refsource": "MISC",
            "url": "https://github.com/dataease/dataease/pull/3328"
          },
          {
            "name": "https://github.com/dataease/dataease/commit/956ee2d6c9e81349a60aef435efc046888e10a6d",
            "refsource": "MISC",
            "url": "https://github.com/dataease/dataease/commit/956ee2d6c9e81349a60aef435efc046888e10a6d"
          },
          {
            "name": "https://github.com/dataease/dataease/releases/tag/v1.15.2",
            "refsource": "MISC",
            "url": "https://github.com/dataease/dataease/releases/tag/v1.15.2"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-q4qq-jhjv-7rh2",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,1.15.2)",
          "affected_versions": "All versions before 1.15.2",
          "cwe_ids": [
            "CWE-1035",
            "CWE-707",
            "CWE-937"
          ],
          "date": "2022-10-18",
          "description": "Improper Neutralization in io.dataease:dataease-plugin-common. If an attacker can add some parameters in JDBC url, and connect to evil mysql server, they can trigger the mysql jdbc deserialization vulnerability, and eventually the attacker can execute through the deserialization vulnerability system commands and obtain server privileges.",
          "fixed_versions": [
            "1.15.2"
          ],
          "identifier": "GMS-2022-5474",
          "identifiers": [
            "GHSA-q4qq-jhjv-7rh2",
            "GMS-2022-5474",
            "CVE-2022-39312"
          ],
          "not_impacted": "All versions starting from 1.15.2",
          "package_slug": "maven/io.dataease/dataease-plugin-common",
          "pubdate": "2022-10-18",
          "solution": "Upgrade to version 1.15.2 or above.",
          "title": "Improper Neutralization",
          "urls": [
            "https://github.com/dataease/dataease/security/advisories/GHSA-q4qq-jhjv-7rh2",
            "https://github.com/advisories/GHSA-q4qq-jhjv-7rh2"
          ],
          "uuid": "a0e6f65d-99fb-4793-b779-792eddaea55f"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.15.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-39312"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-502"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/dataease/dataease/releases/tag/v1.15.2",
              "refsource": "MISC",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "https://github.com/dataease/dataease/releases/tag/v1.15.2"
            },
            {
              "name": "https://github.com/dataease/dataease/commit/956ee2d6c9e81349a60aef435efc046888e10a6d",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/dataease/dataease/commit/956ee2d6c9e81349a60aef435efc046888e10a6d"
            },
            {
              "name": "https://github.com/dataease/dataease/pull/3328",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/dataease/dataease/pull/3328"
            },
            {
              "name": "https://github.com/dataease/dataease/security/advisories/GHSA-q4qq-jhjv-7rh2",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/dataease/dataease/security/advisories/GHSA-q4qq-jhjv-7rh2"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-10-28T18:24Z",
      "publishedDate": "2022-10-25T17:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.