| タイトル | DataEase 2.10.25/2.10.26 Cross Site Scripting |
|---|
| 説明 | DataEase 2.10.25 and 2.10.26, as well as dev-v2 source through commit 0ae4a3d402fb3a3aef9f3edbe217dc0866b3a34f, contain a stored cross-site scripting vulnerability in the symbolic-map tooltip configuration. An authenticated user with manage permission on a dashboard can persist a crafted canvasViewInfo[*].customAttr.tooltip.backgroundColor value through POST /de2api/dataVisualization/updateCanvas. When another user with read permission loads the symbolic-map chart, the value is interpolated into style.innerHTML in core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts (lines 461-474), allowing script execution in the viewer's DataEase browser context. The cross-user data flow and harmless trigger were verified in an authorized local test environment. No executable payload is included in the public report. Class: Stored Cross-Site Scripting (CWE-79). CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4). The vendor was contacted through public GitHub Issue #18846. No CVE has been assigned for this root cause and it has not been submitted to another CNA. This root cause is distinct from GHSA-6pfp-pqvf-xvfg: that advisory concerns bar-horizontal axis-label tooltip data written to innerHTML and was fixed in v2.10.26; this report concerns tooltip.backgroundColor written to style.innerHTML in symbolic-map.ts, which remains present in v2.10.26. |
|---|
| ソース | ⚠️ https://github.com/dataease/dataease/issues/18846 |
|---|
| ユーザー | JunRoinxxX (UID 100281) |
|---|
| 送信 | 2026年08月01日 08:41 (1 月 ago) |
|---|
| モデレーション | 2026年09月12日 13:06 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 403119 [DataEase 迄 2.10.25/2.10.26 Symbolic Map symbolic-map.ts buildTooltip クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|