CVE-2024-30269: DataEase has database configuration information exposure vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 15.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-04-08 · updated 2026-06-17
Weakness: CWE-200

Description

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are available aside from upgrading.

Affected products

dataease: before 2.5.0 — fixed in 2.5.0

How to fix

Upgrade to a fixed version: dataease 2.5.0. Check the vendor advisory for mitigations.

References

https://github.com/dataease/dataease/releases/tag/v2.5.0
https://github.com/dataease/dataease/security/advisories/GHSA-8gvx-4qvj-6vv5
https://github.com/dataease/dataease/releases/tag/v2.5.0
https://github.com/dataease/dataease/security/advisories/GHSA-8gvx-4qvj-6vv5

Get alerted when CVE-2024-30269 or the next vulnerability affects your stack