Medium · 6.5 CVE-2022-34112 EUVD-2022-6312GHSA-c2pj-rr68-pw94

Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin

Published Jul 22, 2022 · Updated Aug 3, 2024 · Assigned by mitre

Package: io.dataease:dataease-plugin-common Ecosystem: Maven

Description

An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	io.dataease:dataease-plugin-common	< 1.11.2	1.11.2	GHSA-c2pj-rr68-pw94

References

https://github.com/dataease/dataease/issues/2429