SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10.
References
Link | Resource |
---|---|
https://github.com/dataease/dataease/issues/510 | Exploit Issue Tracking Vendor Advisory |
https://github.com/dataease/dataease/issues/510 | Exploit Issue Tracking Vendor Advisory |
Configurations
History
21 Nov 2024, 06:16
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/dataease/dataease/issues/510 - Exploit, Issue Tracking, Vendor Advisory |
Information
Published : 2023-02-15 22:15
Updated : 2024-11-21 06:16
NVD link : CVE-2021-38239
Mitre link : CVE-2021-38239
CVE.ORG link : CVE-2021-38239
JSON object : View
Products Affected
dataease
- dataease
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')