medium5.3Public exploit code
CVE-2024-30269
DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DataEase 2.4.0 - Database Configuration Information Exposure2025-04-06 · webapps · java
Impact
DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dataease | Dataease | before 2.5.0 |