Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2024-52295: DataEase before 2.10.2 lets attackers create fake login tokens
CVE-2024-52295 · published 1 year ago
Summary
The open‑source DataEase tool (versions earlier than 2.10.2) uses a hard‑coded secret for its authentication tokens, allowing someone to craft a fake token and gain control of the service. This could let an unauthorized person view or modify your data visualizations. Upgrade to version 2.10.2 or later, which replaces the hard‑coded secret with a secure, configurable one.
What to do
- Update dataease dataease to version 2.10.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dataease | dataease |
< 2.10.2 cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* |
Original advisory text
DataEase has a forged JWT token vulnerability
DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2.
References
- https://github.com/dataease/dataease/security/advisories/GHSA-45v9-gfcv-xcq6 Vendor Advisory
- https://github.com/dataease/dataease/commit/e755248d59543bcd668ace495f293ff735fa... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52295... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-52295 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
9.1
Critical
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published13 Nov 2024
Updated3 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta