What is GHSA-5469-c5p2-xv5g?

GHSA-5469-c5p2-xv5g is a security advisory published by GitHub Security Advisories with Critical severity. Dataease before 1.11.2 allows arbitrary code execution via crafter plugin

Which CVE IDs does GHSA-5469-c5p2-xv5g cover?

GHSA-5469-c5p2-xv5g covers the following CVE IDs: CVE-2022-34113. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5469-c5p2-xv5g?

GHSA-5469-c5p2-xv5g has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-5469-c5p2-xv5g?

GHSA-5469-c5p2-xv5g affects 1 product, including: maven/io.dataease:dataease-plugin-common:\u003c= 1.11.1.

GHSA-5469-c5p2-xv5gCriticalCVSS 9.8

Dataease before 1.11.2 allows arbitrary code execution via crafter plugin

Vendor

GitHub Security Advisories

Published

July 23, 2022

Last Modified

August 17, 2023

🔗 CVE IDs covered (1)

CVE-2022-34113 →

📋 Description

An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. Version 1.11.2 contains a patch for the problem.

🎯 Affected products1

maven/io.dataease:dataease-plugin-common:<= 1.11.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-34113
https://github.com/dataease/dataease/issues/2431
https://github.com/dataease/dataease/releases/tag/v1.11.2
https://github.com/advisories/GHSA-5469-c5p2-xv5g