Medium severity · published Feb 28, 2023
CVE-2023-25807
DataEase is an open source data visualization and analysis tool
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses the dashboard. The vulnerability has been fixed in version 1.18.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Dataease · Dataease
before 1.18.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-25807
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-25807
Patch
https://github.com/dataease/dataease/commit/cc94fb8e69ddbb37c96d02ec0f0ddcd74273ef49
Exploit
https://github.com/dataease/dataease/security/advisories/GHSA-xj3h-3wmw-j5vf
More from Dataease
9.8
CVE-2026-33122
DataEase has SQL Injection via Datasource Management
9.8
CVE-2026-33082
DataEase: SQL Injection in v2 Dataset Export
9.8
CVE-2026-23958
DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover
9.8
CVE-2025-64428
DataEase DB2 JNDI Vulnerability
9.8
CVE-2025-64164
DataEase is vulnerable to Oracle JNDI Injection