DataEase v2.10.21 Security Update: Fixes SQLi, Arbitrary File Read, Auth Bypass

Vulnerability Overview DataEase v2.10.21 fixes multiple security vulnerabilities, mainly including SQL injection vulnerabilities, arbitrary file read vulnerabilities, runtime permission issues, SQL injection bypass vulnerabilities, authentication forgery bypass vulnerabilities, and SAML response parser injection vulnerabilities. Impact Scope SQL Injection Vulnerabilities: Affect dataset export, ORDER BY clause, getFielEnumObj endpoint, data source save flow, data source management, CalciteProvider, remote execution included in Quartz, SQL Injection via Stacked Queries, share link authentication mechanism, XXE Injection in SAML Response Parser. Arbitrary File Read Vulnerability: Affects Arbitrary File Read (Credential Exfiltration). Runtime Permission Issue: Affects remote execution included in Quartz. SQL Injection Bypass Vulnerability: Affects SQL Injection via Stacked Queries. Authentication Forgery Bypass Vulnerability: Affects share link authentication mechanism. SAML Response Parser Injection Vulnerability: Affects XXE Injection in SAML Response Parser. Remediation Measures SQL Injection Vulnerabilities: Fixed SQL injection vulnerabilities in dataset export, ORDER BY clause, getFielEnumObj endpoint, data source save flow, data source management, CalciteProvider, remote execution included in Quartz, SQL Injection via Stacked Queries, share link authentication mechanism, and XXE Injection in SAML Response Parser. Arbitrary File Read Vulnerability: Fixed the Arbitrary File Read (Credential Exfiltration) vulnerability. Runtime Permission Issue: Fixed the remote execution permission issue included in Quartz. SQL Injection Bypass Vulnerability: Fixed the SQL Injection via Stacked Queries vulnerability. Authentication Forgery Bypass Vulnerability: Fixed the authentication forgery bypass vulnerability in the share link authentication mechanism. SAML Response Parser Injection Vulnerability: Fixed the XXE Injection in SAML Response Parser vulnerability. POC Code or Exploit Code The page does not contain specific POC code or exploit code. Summary DataEase v2.10.21 fixes multiple critical security vulnerabilities, including SQL injection, arbitrary file read, runtime permission issues, SQL injection bypass, authentication forgery bypass, and SAML response parser injection. Users are advised to upgrade to this version as soon as possible to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

DataEase v2.10.21 Security Update: Fixes SQLi, Arbitrary File Read, Auth Bypass

More from this source