CVE-2023-32310

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-32310
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32310.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-32310
Aliases
Published
2023-06-01T15:05:00.439Z
Modified
2026-08-07T20:26:18.570399Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
DataEase API interface has IDOR vulnerability
Details

DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboard or messages or interfering with the interface for marking messages read. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32310.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "1.18.7"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-639"
    ]
}
References

Affected packages

Git / github.com/dataease/dataease

Affected ranges

Type
GIT
Repo
https://github.com/dataease/dataease
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1b102628f23716bad44cb6ff3feede0607e5d56d
Fixed
72f428e87b5395c03d2f94ef6185fc247ddbc8dc
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.18.7"
        }
    ],
    "cpe": "cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.18.0
v1.18.1
v1.18.2
v1.18.4
v1.18.5
v1.18.6

Database specific

vanir_signatures 
[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "232141079197160792699758721493426083699",
                "270677469198222700807622242594870930159",
                "115970030529536120447298012169843818053",
                "78400093423959119948933055448826258175",
                "80950330996202193184810379716162391945",
                "272804063556145000103379729556217374735",
                "106374695511783582696393796727235263627",
                "107585864096350392372186843528828175885",
                "37732953644519705848452757644423653059",
                "133114603716008189803229551776726199171",
                "674558733184782003880131710137595223",
                "328617789955942912836537669087226555992",
                "52467053860641706278931460039606698936",
                "51349523974210367538493033114015052652",
                "337588713513586195101161920744813793384",
                "41497590521216295357938560770039143166",
                "262142403170135006930198896359913124189",
                "80373338072932419156291383745045999629",
                "203202187975125611665616509689322995565"
            ]
        },
        "id": "CVE-2023-32310-7400fd72",
        "signature_type": "Line",
        "source": "https://github.com/dataease/dataease/commit/72f428e87b5395c03d2f94ef6185fc247ddbc8dc",
        "target": {
            "file": "backend/src/main/java/io/dataease/service/panel/ShareService.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1492.0,
            "function_hash": "52035231335436030312538055380873164890"
        },
        "id": "CVE-2023-32310-b0c13986",
        "signature_type": "Function",
        "source": "https://github.com/dataease/dataease/commit/72f428e87b5395c03d2f94ef6185fc247ddbc8dc",
        "target": {
            "function": "removeSharesyPanel",
            "file": "backend/src/main/java/io/dataease/service/panel/ShareService.java"
        }
    }
]
vanir_signatures_modified 
"2026-08-07T20:26:18Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32310.json"