CVE-2024-47073

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The vulnerability has been fixed in v2.10.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published: Nov 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-470749.8DataEase is an open source data visualization analysis tool. In Dataease, the PostgreSQL data source in the data source function can customi CVE-2024-470756.1LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to CVE-2024-470768.6CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` p CVE-2024-470776.5authentik is an open-source identity provider. Prior to versions 2024.8.3 and 2024.6.5, access tokens issued to one application can be stole CVE-2024-470789.8Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a sh CVE-2024-470796.4Meshtastic is an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic firmware is an CVE-2024-47089.8mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.CVE-2024-470808.7matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the m CVE-2024-470815.3Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for s CVE-2024-470828.0Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL CVE-2024-470837.5Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an is CVE-2024-470848.3Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to **CORS origin validation**, where t