CVE-2024-46997

Deeper analysis

DataEase, an open source data visualization analysis tool, contains a remote command execution vulnerability in versions prior to 2.10.1. The flaw, tracked as CVE-2024-46997 and assigned CWE-74, allows an attacker to supply a maliciously crafted H2 database connection string that results in arbitrary command execution on the server. The issue carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.

An unauthenticated attacker with network access can add the malicious data source through the application's normal connection configuration workflow, achieving full control over the underlying host including the ability to read, modify, or delete data and execute system commands. Because the vector requires no privileges, the impact extends to any internet-exposed or internally reachable DataEase instance that accepts user-supplied data sources.

The official advisory published in the DataEase GitHub repository states that the vulnerability has been resolved in version 2.10.1; administrators are advised to upgrade immediately and to restrict or review any existing H2 data source definitions until patches are applied.

EPSS for the CVE rose from a low baseline to a peak of 0.2129, indicating that exploitation interest emerged after public disclosure and that the issue warrants renewed defensive attention.