High severity7.5NVD Advisory· Published Sep 23, 2024· Updated Jun 17, 2026

CVE-2024-46985

Description

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading. The vulnerability has been fixed in v2.10.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.dataease:commonMaven	< 2.10.1	2.10.1

Affected products

Dataease/Dataease2 versions
cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*range: <2.10.1
- (no CPE)range: < 2.10.1
ghsa-coords
pkg:maven/io.dataease/common
Range: < 2.10.1

Patches

Vulnerability mechanics

References

github.com/dataease/dataease/security/advisories/GHSA-4m9p-7xg6-f4mmnvdExploitVendor AdvisoryWEB
github.com/advisories/GHSA-4m9p-7xg6-f4mmghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-46985ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000