Vulnerabilities ›

CVE-2026-33084

High ⚡ Exploit Available

CWE-89 — Weakness Type

                    Published: Apr 16, 2026                      ·  Modified: Apr 23, 2026                      ·  Source: NVD                

CVSS v3

8.8

🔗 NVD Official

📄 Description (English)

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The DatasetDataManage service layer directly transfers the user-supplied sort value to the sorting metadata DTO, which is passed to Order2SQLObj where it is incorporated into the SQL ORDER BY clause without any whitelist validation, and then executed via CalciteProvider. An authenticated attacker can inject arbitrary SQL commands through the sort parameter, enabling time-based blind SQL injection. This issue has been fixed in version 2.10.21.

🤖 AI Executive Summary

DataEase versions 2.10.20 and below contain a critical SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. An authenticated attacker can inject arbitrary SQL commands through unsanitized input, enabling time-based blind SQL injection attacks. This vulnerability affects organizations using DataEase for data visualization and analytics, particularly those in Saudi Arabia's banking, government, and energy sectors that rely on this platform for business intelligence.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: Apr 23, 2026 03:13

🇸🇦 Saudi Arabia Impact Assessment

High impact on Saudi organizations using DataEase for business intelligence and analytics. Most at-risk sectors include: (1) Banking sector and SAMA-regulated institutions relying on DataEase for financial analytics and reporting; (2) Government agencies (NCA, ministries) using the platform for data analysis and decision support; (3) Energy sector (ARAMCO, utilities) leveraging DataEase for operational analytics; (4) Telecommunications (STC, Mobily) using the platform for network and customer analytics; (5) Healthcare organizations using DataEase for patient data analysis. Authenticated access requirement reduces immediate risk but internal threats and compromised credentials pose significant concern. Potential for data exfiltration, unauthorized access to sensitive analytics, and business intelligence theft.

🏢 Affected Saudi Sectors

Banking and Financial Services Government and Public Administration Energy and Utilities Telecommunications Healthcare Insurance Retail and E-commerce Manufacturing

🎯 MITRE ATT&CK Techniques

T1190 - Exploit Public-Facing Application T1110 - Brute Force T1078 - Valid Accounts T1059 - Command and Scripting Interpreter T1083 - File and Directory Discovery T1005 - Data from Local System T1041 - Exfiltration Over C2 Channel T1557 - Man-in-the-Middle

⚖️ Saudi Risk Score (AI)

8.2

/ 10.0

🔧 Remediation Steps (English)

IMMEDIATE ACTIONS:

1. Identify all DataEase instances in your environment running versions 2.10.20 or below

2. Restrict access to the /de2api/datasetData/enumValueObj endpoint to trusted users only

3. Implement network-level access controls limiting API access to authorized networks

4. Monitor authentication logs for suspicious login patterns and credential abuse

PATCHING GUIDANCE:

1. Upgrade DataEase to version 2.10.21 or later immediately when available

2. Test patches in non-production environments before deployment

3. Plan maintenance windows for production upgrades with minimal business impact

4. Maintain backup and rollback procedures during patching

COMPENSATING CONTROLS (until patch available):

1. Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in sort parameters

2. Apply input validation at application layer - whitelist allowed sort field names and directions (ASC/DESC only)

3. Use database query parameterization and prepared statements

4. Implement database activity monitoring (DAM) to detect anomalous SQL queries

5. Restrict database user privileges to minimum required permissions

6. Enable SQL query logging and audit trails

DETECTION RULES:

1. Monitor for unusual characters in sort parameter: single quotes, semicolons, SQL keywords (UNION, SELECT, DROP, etc.)

2. Alert on time-based delays in API responses from /de2api/datasetData/enumValueObj endpoint

3. Track failed database queries and authentication attempts

4. Monitor for multiple rapid requests to the vulnerable endpoint

5. Log all API calls to this endpoint with full request/response payloads

6. Alert on database error messages in application logs containing SQL syntax errors

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. حدد جميع مثيلات DataEase في بيئتك التي تعمل بالإصدارات 2.10.20 أو أقدم

2. قيد الوصول إلى نقطة النهاية /de2api/datasetData/enumValueObj للمستخدمين الموثوقين فقط

3. طبق عناصر التحكم في الوصول على مستوى الشبكة لتحديد وصول API للشبكات المصرح بها

4. راقب سجلات المصادقة للأنماط المريبة وإساءة استخدام بيانات الاعتماد

إرشادات التصحيح:

1. قم بترقية DataEase إلى الإصدار 2.10.21 أو أحدث فوراً عند توفره

2. اختبر التصحيحات في بيئات غير الإنتاج قبل النشر

3. خطط نوافذ الصيانة لترقيات الإنتاج بأقل تأثير على الأعمال

4. احتفظ بإجراءات النسخ الاحتياطي والتراجع أثناء التصحيح

عناصر التحكم التعويضية (حتى توفر التصحيح):

1. طبق قواعد جدار حماية تطبيقات الويب (WAF) للكشف عن أنماط حقن SQL وحجبها

2. طبق التحقق من المدخلات على مستوى التطبيق - قائمة بيضاء لأسماء حقول الفرز والاتجاهات المسموحة فقط

3. استخدم معاملات قاعدة البيانات والبيانات المحضرة

4. طبق مراقبة نشاط قاعدة البيانات (DAM) للكشف عن استعلامات SQL الشاذة

5. قيد امتيازات مستخدم قاعدة البيانات للحد الأدنى المطلوب

6. فعّل تسجيل استعلامات SQL ومسارات التدقيق

قواعد الكشف:

1. راقب الأحرف غير العادية في معامل الفرز: علامات اقتباس مفردة وفواصل منقوطة وكلمات SQL الرئيسية

2. تنبيه على التأخيرات المستندة إلى الوقت في استجابات API من نقطة النهاية

3. تتبع استعلامات قاعدة البيانات الفاشلة ومحاولات المصادقة

4. راقب الطلبات السريعة المتعددة إلى نقطة النهاية الضعيفة

5. سجل جميع استدعاءات API لهذه النقطة مع حمولات الطلب/الاستجابة الكاملة

6. تنبيه على رسائل خطأ قاعدة البيانات في سجلات التطبيق التي تحتوي على أخطاء بناء جملة SQL

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

A.14.2.1 - Secure development policy and procedures A.14.2.5 - Secure development environment A.13.1.1 - Information security event logging A.13.2.1 - Monitoring of information systems A.12.4.1 - Event logging A.12.6.1 - Management of technical vulnerabilities

🔵 SAMA CSF

ID.BE-5 - Organizational resilience with respect to cybersecurity risk PR.DS-6 - Integrity checking mechanisms PR.IP-1 - System development and acquisition processes DE.CM-1 - The network is monitored to detect potential cybersecurity events RS.MI-2 - Incidents are mitigated

🟡 ISO 27001:2022

A.14.2.1 - Secure development policy A.14.2.5 - Secure development environment A.13.1.1 - Information security event logging A.13.2.1 - Monitoring of information systems A.12.6.1 - Management of technical vulnerabilities A.12.4.1 - Event logging

🟣 PCI DSS v4.0.1

6.2 - Ensure that all system components and software are protected from known vulnerabilities 6.5.1 - Injection flaws prevention 10.2 - Implement automated audit trails for all access to cardholder data 10.3 - Protect audit trail history from alteration

🔗 References & Sources 2

🔗

https://github.com/dataease/dataease/releases/tag/v2.10.21

security-advisories@github.com

Release Notes

🔗

https://github.com/dataease/dataease/security/advisories/GHSA-r897-r9q8-3p2x

security-advisories@github.com

Exploit Third Party Advisory

📦 Affected Products / CPE 1 entries

dataease:dataease

📊 CVSS Score

8.8

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityH — High

📋 Quick Facts

Severity High

CVSS Score8.8

CWECWE-89

EPSS0.03%

Exploit ✓ Yes

Patch ✗ No

Published 2026-04-16

Source Feed nvd

🇸🇦 Saudi Risk Score

8.2

/ 10.0 — Saudi Risk

Priority: CRITICAL

🏷️ Tags

exploit-available CWE-89

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-33084

💬 Comments

Introduce Yourself

Sign In Required