CVE-2024-56511
CriticalPublic exploitPrior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access.
Published Jan 10, 2025 · Updated Aug 12, 2026 · Also known as GHSA-9f69-p73j-m73x
Key Facts
Patch immediately- CVE-2024-56511 is a critical-severity vulnerability (CVSS 9.3 v4) affecting Dataease.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 50% probability of exploitation in the next 30 days.
- Fixed versions are available, including Dataease 2.10.4.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v4
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
50%
Higher than 98.8% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2024-56511 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class, ”request.getRequestURI“ is used to obtain the request URL, and it is passed to the "WhitelistUtils.match" method to determine whether the URL request is an interface that does not require authentication. The "match" method filters semicolons, but this is not enough. When users set "server.servlet.context-path" when deploying products, there is still a risk of being bypassed, which can be bypassed by any whitelist prefix /geo/../context-path/. The vulnerability has been fixed in v2.10.4.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| DataeaseDataease | >= < 2.10.4 | 2.10.4 |
Patched Releases
Dataease
2.10.4
Timeline
Publicly disclosed
Jan 10, 2025
Last updated
Aug 12, 2026
Weakness Type
- CWE-289 Authentication Bypass by Alternate Name
References
FAQ
Common Questions.
DataEase is an open source data visualization analysis tool.
Affected: Dataease versions >= < 2.10.4. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Dataease 2.10.4.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2024-56511 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo