[0day-rubbish] Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 unrestricted scheduler job-type deserialization to Agent-host command execution (8.1)
Dataedo Portal 26.2.8 can push a deserialized scheduler job that the Agent runs as host commands.
Researchers disclosed a cross-component flaw in Dataedo Portal 26.2.8 and Dataedo Agent 26.2.8, the closed-source enterprise data-catalog platform from Dataedo in Poland. The Portal reveals a database credential, and unrestricted deserialization of a scheduler job type makes the separately installed Agent execute commands on its own host. The issue is scored 8.1, with no CVE or observed exploitation stated.
- Chain starts with a database credential disclosed by Dataedo Portal.
- Unrestricted scheduler job deserialization runs commands on the Agent host.
- Affects Portal and Agent 26.2.8 and is scored 8.1.
- Vendors
- Dataedo
- Products
- Dataedo PortalDataedo Agent
- Organizations
- 0day Rubbish Research TeamDataedo
- Countries
- Poland
From the original article
Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in Dataedo Portal 26. 2. 8 together with Dataedo Agent 26.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.