Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2023-28437

SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed

Description

Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

dataease dataease

  • < 1.18.5affected

References