CVE-2022-23331
HIGHCVSS 8.8/10EPSS 1.16%
Last modified
CVE-2022-23331 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password.. EPSS estimates a 1.16% chance of exploitation in the next 30 days.
Description
In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dataease | Dataease | 1.6.1 |
References
- https://github.com/dataease/dataease/issues/1618Exploit, Issue Tracking, Third Party Advisory
- https://github.com/dataease/dataease/issues/1618Exploit, Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-23331?
In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password.
How severe is CVE-2022-23331?
CVE-2022-23331 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 1.16% probability of exploitation in the next 30 days.
How do I fix CVE-2022-23331?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-23321A persistent cross-site scripting (XSS) vulnerability exists…4.8
- CVE-2022-23327A design flaw in Go-Ethereum 1.10.12 and older versions allo…7.5
- CVE-2022-23328A design flaw in all versions of Go-Ethereum allows an attac…7.5
- CVE-2022-23329A vulnerability in ${"freemarker.template.utility.Execute"?n…9.8
- CVE-2022-2333If an attacker manages to trick a valid user into loading a …7.8
- CVE-2022-23330A remote code execution (RCE) vulnerability in HelloWorldAdd…8.8
- CVE-2022-23332Command injection vulnerability in Manual Ping Form (Web UI)…8.8
- CVE-2022-23334The Robot application in Ip-label Newtest before v8.5R0 was …9.8
- CVE-2022-23335Metinfo v7.5.0 was discovered to contain a SQL injection vul…9.8
- CVE-2022-23336S-CMS v5.0 was discovered to contain a SQL injection vulnera…9.8
- CVE-2022-23337DedeCMS v5.7.87 was discovered to contain a SQL injection vu…9.8
- CVE-2022-2334The application searches for a library dll that is not found…7.2
Are you affected by CVE-2022-23331?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST