CVE-2023-40772 PUBLISHED

Assigner: mitre
Reserved: 22.08.2023 Published: 14.09.2026 Updated: 14.09.2026

A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	DataEase
Product	DataEase
Versions	Default: unaffected affected from 0 to 1.18.10 (excl.)

References

https://github.com/dataease/dataease/issues/5864

Problem Types

CWE-23 Relative Path Traversal CWE