title: SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed
description: Dataease is an open source data visualization and analysis tool. The blacklist for SQL injection protection is missing entries. This vulnerability has been fixed in version 1.18.5. There are no known workarounds.
problem types: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
vendor: dataease
product: dataease
versions:
version: < 1.18.5, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]