CVE-2022-34112: Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin

July 23, 2022 (updated July 27, 2022)

An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator.

References

github.com/advisories/GHSA-c2pj-rr68-pw94
github.com/dataease/dataease/commit/5f611d3e3934816e9ad34e3d21807978001e2c8b
github.com/dataease/dataease/issues/2429
github.com/dataease/dataease/releases/tag/v1.11.2
nvd.nist.gov/vuln/detail/CVE-2022-34112

Detect and mitigate CVE-2022-34112 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →