CVE-2024-30269 in dataease
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading.
Affected software: dataease
Scores
- CVSS: 5.3 (medium)
- EPSS: 15.88% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2024-04-08
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.