CVE-2024-30269

—

CVSS 3.1

5.3 medium

EPSS

16%p97

Published

Apr 8, 2024 (Apr 8, 2024)

Modified

Jun 17, 2026

Description

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading.

Vendors: dataease
Products: dataease
Weakness: CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (15.9%)

In the news0 stories

No ingested article mentions this CVE yet.