cve.bz

CVE-2024-46985

7.5 highEPSS 0.7%

High (7.5) in dataease dataease. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in io.dataease:common 2.10.1.

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE
CWE-611
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4m9p-7xg6-f4mmMavenio.dataease:common<2.10.12.10.1

References

Check your stackJSON