critical9.8
CVE-2022-34113
Dataease before 1.11.2 allows arbitrary code execution via crafter plugin
Impact
An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. Version 1.11.2 contains a patch for the problem.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.dataease:dataease-plugin-common | <= 1.11.1 | 1.11.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dataease | Dataease | Version 1.11.1 |