CVE-2024-52295
DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2.
- Affected products
- Dataease
- Dataease
- < 2.10.2
- Fix
- Available
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 0.8% (54th percentile)
- Weakness
- CWE-798
- NVD status
- Analyzed
- Published
- 2024-11-13
CVE-2024-52295 at NVD
No indexed exploits for CVE-2024-52295 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2024-52295 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.