VYPR
← All advisories
High severityNVD Advisory· Published Jun 1, 2023· Updated Jan 8, 2025

DataEase API interface has IDOR vulnerability

CVE-2023-32310

Description

DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboard or messages or interfering with the interface for marking messages read. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
io.dataease:dataease-plugin-commonMaven
< 1.18.71.18.7

Affected products

1

Patches

1
72f428e87b53

feat(仪表板): 删除分享IDOR漏洞

https://github.com/dataease/dataeasefit2cloud-chenywMay 29, 2023via ghsa
commit
1 file changed · +6 −3
  • backend/src/main/java/io/dataease/service/panel/ShareService.java+6 −3 modified
    @@ -4,12 +4,11 @@
 import io.dataease.auth.api.dto.CurrentRoleDto;
 import io.dataease.auth.api.dto.CurrentUserDto;
 import io.dataease.commons.constants.SysLogConstants;
-import io.dataease.commons.utils.DeLogUtils;
-import io.dataease.ext.ExtPanelShareMapper;
 import io.dataease.commons.model.AuthURD;
 import io.dataease.commons.utils.AuthUtils;
 import io.dataease.commons.utils.BeanUtils;
 import io.dataease.commons.utils.CommonBeanFactory;
+import io.dataease.commons.utils.DeLogUtils;
 import io.dataease.controller.request.panel.PanelShareFineDto;
 import io.dataease.controller.request.panel.PanelShareRemoveRequest;
 import io.dataease.controller.request.panel.PanelShareRequest;
@@ -18,6 +17,7 @@
 import io.dataease.dto.panel.PanelShareDto;
 import io.dataease.dto.panel.PanelShareOutDTO;
 import io.dataease.dto.panel.PanelSharePo;
+import io.dataease.ext.ExtPanelShareMapper;
 import io.dataease.plugins.common.base.domain.PanelGroup;
 import io.dataease.plugins.common.base.domain.PanelShare;
 import io.dataease.plugins.common.base.domain.PanelShareExample;
@@ -390,8 +390,11 @@ public void removeSharesyPanel(String panelId) {
         PanelShareRemoveRequest request = new PanelShareRemoveRequest();
         request.setPanelId(panelId);
         List<PanelShareOutDTO> panelShareOutDTOS = queryTargets(panelId);
+        if (CollectionUtils.isEmpty(panelShareOutDTOS) || ObjectUtils.isEmpty(panelGroup)) {
+            return;
+        }
         extPanelShareMapper.removeShares(request);
-        if (CollectionUtils.isEmpty(panelShareOutDTOS) || ObjectUtils.isEmpty(panelGroup) || StringUtils.isBlank(panelGroup.getName())) {
+        if (StringUtils.isBlank(panelGroup.getName())) {
             return;
         }
         panelShareOutDTOS.forEach(shareOut -> {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.