CVE-2023-28637

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-28637

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-28637.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-28637

Aliases

GHSA-8wg2-9gwc-5fx2

Published

2023-03-28T20:02:54.017Z

Modified

2026-07-15T01:49:21.186883948Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

DataEase AWS redshift data source exists for remote code execution vulnerability

Details

DataEase is an open source data visualization analysis tool. In Dataease users are normally allowed to modify data and the data sources are expected to properly sanitize data. The AWS redshift data source does not provide data sanitization which may lead to remote code execution. This vulnerability has been fixed in v1.18.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific

{
    "cwe_ids": [
        "CWE-74"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28637.json"
}

References

Affected packages

Git / github.com/dataease/dataease

Affected ranges

Type

GIT

Repo

https://github.com/dataease/dataease

Events

Introduced

Fixed

ef67a791f47ac53ce3695c46c2a89357b083ce6d

Database specific

{
    "cpe": "cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.18.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v1.*

v1.0.0

v1.18.0

v1.18.1

v1.18.2

v1.18.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-28637.json"