CVE-2023-28435

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 24, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-284368.0Tailscale is software for using Wireguard and multi-factor authentication (MFA). A vulnerability identified in the implementation of TailscaCVE-2023-284379.8Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulneraCVE-2023-284388.0Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can alreaCVE-2023-284396.1CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered affecting IfrCVE-2023-28444.9Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.CVE-2023-284402.7Discourse is an open source platform for community discussion. In affected versions a maliciously crafted request from a Discourse administrCVE-2023-284417.5smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stoCVE-2023-284425.3GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.CVE-2023-284435.5Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is noCVE-2023-284447.5angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment vCVE-2023-284459.8Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions tCVE-2023-284468.8Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without
CVE-2023-28435: Medium severity, CVSS 6.1 | Vulnix