Chartbrew versions before 4.8.1: Attacker can run unauthorized code

Summary

Chartbrew, a web app that connects to databases and APIs, has a security flaw that could allow an attacker to execute unauthorized code on a server. This could lead to data theft or other malicious activities. Update to version 4.8.1 to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
depomo	chartbrew	<= 4.8.1	–

Original title

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnerability...

Original description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, there is a remote code execution vulnerability via a vulnerable API. This issue has been patched in version 4.8.1.

nvd CVSS3.1 8.8

Vulnerability type

CWE-94 Code Injection