CVE-2024-56511
DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class, ”request.getRequestURI“ is used to obtain the request URL, and it is passed to the "WhitelistUtils.match" method to determine whether the URL request is an interface that does not require authentication. The "match" method filters semicolons, but this is not enough. When users set "server.servlet.context-path" when deploying products, there is still a risk of being bypassed, which can be bypassed by any whitelist prefix /geo/../context-path/. The vulnerability has been fixed in v2.10.4.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 44.46%
- CWE
- CWE-289
- Published
- 2025-01-10
- Last modified
- 2026-03-13
Affected products
- dataease dataease
Weakness type
Related vulnerabilities
- CVE-2026-15980 — MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token
- CVE-2026-32639 — Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
- CVE-2026-15985 — Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login
- CVE-2026-8457 — WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
- CVE-2026-10842 — IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability
- CVE-2026-9701 — Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation
- CVE-2026-55075 — Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
- CVE-2026-56091 — Apache Shiro: Authentication bypass in Guice-Web integration