GHSA-c2pj-rr68-pw94
Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.dataease:dataease-plugin-common | < 1.11.2 | 1.11.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator. Version 1.11.2 contains a patch for this issue.
References
External links from the advisory. They lead to third-party sites.