Vulnerabilities ›

CVE-2026-33207

High ⚡ Exploit Available

CWE-89 — Weakness Type

                    Published: Apr 16, 2026                      ·  Modified: Apr 23, 2026                      ·  Source: NVD                

CVSS v3

8.8

🔗 NVD Official

📄 Description (English)

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /datasource/getTableField endpoint. The getTableFiledSql method in CalciteProvider.java incorporates the tableName parameter directly into SQL query strings using String.format without parameterization or sanitization. Although DatasourceServer.java validates that the table name exists in the datasource, an attacker can bypass this by first registering an API datasource with a malicious deTableName, which is then returned by getTables and passes the validation check. An authenticated attacker can execute arbitrary SQL commands, enabling error-based extraction of sensitive database information. This issue has been fixed in version 2.10.21.

🤖 AI Executive Summary

DataEase versions 2.10.20 and below contain a critical SQL injection vulnerability in the /datasource/getTableField endpoint that allows authenticated attackers to execute arbitrary SQL commands and extract sensitive database information. The vulnerability exists because the tableName parameter is directly incorporated into SQL queries without proper parameterization, and can be exploited by registering a malicious API datasource that bypasses validation checks. This poses an immediate threat to organizations using DataEase for analytics and data visualization, particularly those handling sensitive business intelligence data.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: Apr 23, 2026 03:13

🇸🇦 Saudi Arabia Impact Assessment

This vulnerability poses significant risk to Saudi organizations in the financial services sector (banks and SAMA-regulated entities) that use DataEase for business intelligence and analytics. Government agencies under NCA oversight using DataEase for data analysis and reporting are also at risk. Healthcare organizations (MOH, private hospitals) utilizing DataEase for patient data analytics could face data breach exposure. Energy sector organizations (ARAMCO, utilities) and telecommunications companies (STC, Mobily) using DataEase for operational analytics are vulnerable. The authenticated nature of the attack means insider threats or compromised user accounts could lead to unauthorized access to sensitive business data, financial records, and operational intelligence. The error-based SQL injection capability enables attackers to systematically extract database schemas and sensitive information.

🏢 Affected Saudi Sectors

Banking and Financial Services Government and Public Administration Healthcare Energy and Utilities Telecommunications Insurance Retail and E-commerce

🎯 MITRE ATT&CK Techniques

T1190 - Exploit Public-Facing Application T1110 - Brute Force T1078 - Valid Accounts T1005 - Data from Local System T1213 - Data from Information Repositories T1040 - Network Sniffing T1557 - Adversary-in-the-Middle

⚖️ Saudi Risk Score (AI)

8.2

/ 10.0

🔧 Remediation Steps (English)

IMMEDIATE ACTIONS:

1. Identify all DataEase instances in your environment and document their versions

2. Restrict access to DataEase to trusted networks only using firewall rules

3. Implement additional authentication controls (MFA) for DataEase user accounts

4. Monitor /datasource/getTableField endpoint for suspicious activity

5. Review API datasource configurations for any suspicious or unusual entries

PATCHING GUIDANCE:

1. Upgrade DataEase to version 2.10.21 or later immediately when available

2. If immediate patching is not possible, disable the /datasource/getTableField endpoint or restrict it to administrative users only

3. Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the tableName parameter

COMPENSATING CONTROLS:

1. Implement database-level access controls limiting DataEase service account privileges to read-only on non-sensitive tables

2. Enable database query logging and audit all queries executed by DataEase service accounts

3. Implement network segmentation to isolate DataEase from sensitive database systems

4. Deploy intrusion detection systems (IDS) to monitor for SQL injection attack patterns

DETECTION RULES:

1. Monitor for POST requests to /datasource/getTableField with special characters (', ", ;, --, /*) in tableName parameter

2. Alert on database error messages returned in HTTP responses from DataEase endpoints

3. Track creation of new API datasources with unusual or suspicious names containing SQL keywords

4. Monitor database query logs for UNION-based or error-based SQL injection patterns originating from DataEase service account

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. تحديد جميع نسخ DataEase في بيئتك وتوثيق إصداراتها

2. تقييد الوصول إلى DataEase للشبكات الموثوقة فقط باستخدام قواعد جدار الحماية

3. تطبيق عناصر تحكم مصادقة إضافية (MFA) لحسابات مستخدمي DataEase

4. مراقبة نقطة النهاية /datasource/getTableField للنشاط المريب

5. مراجعة تكوينات مصادر بيانات API للبحث عن أي إدخالات مريبة أو غير عادية

إرشادات التصحيح:

1. ترقية DataEase إلى الإصدار 2.10.21 أو أحدث فوراً عند توفره

2. إذا لم يكن التصحيح الفوري ممكناً، قم بتعطيل نقطة النهاية /datasource/getTableField أو قصر الوصول عليها على المستخدمين الإداريين فقط

3. تطبيق قواعد جدار تطبيقات الويب (WAF) لحجب أنماط حقن SQL في معامل tableName

عناصر التحكم البديلة:

1. تطبيق عناصر تحكم الوصول على مستوى قاعدة البيانات لتحديد امتيازات حساب خدمة DataEase للقراءة فقط على الجداول غير الحساسة

2. تفعيل تسجيل استعلامات قاعدة البيانات ومراجعة جميع الاستعلامات المنفذة بواسطة حسابات خدمة DataEase

3. تطبيق تقسيم الشبكة لعزل DataEase عن أنظمة قاعدة البيانات الحساسة

4. نشر أنظمة كشف الاختراق (IDS) لمراقبة أنماط هجمات حقن SQL

قواعد الكشف:

1. مراقبة طلبات POST إلى /datasource/getTableField بأحرف خاصة (', ", ;, --, /*) في معامل tableName

2. التنبيه على رسائل خطأ قاعدة البيانات المرجعة في الاستجابات من نقاط نهاية DataEase

3. تتبع إنشاء مصادر بيانات API جديدة بأسماء غير عادية أو مريبة تحتوي على كلمات مفتاحية SQL

4. مراقبة سجلات استعلامات قاعدة البيانات لأنماط حقن SQL القائمة على UNION أو الأخطاء من حساب خدمة DataEase

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

5.1.1 - Access Control and Authentication 5.2.1 - Data Protection and Encryption 5.3.1 - Vulnerability Management 5.4.1 - Incident Detection and Response 5.5.1 - Security Monitoring and Logging

🔵 SAMA CSF

ID.AM-2 - Software Inventory PR.AC-1 - Access Control PR.DS-1 - Data Security DE.CM-1 - Detection Processes RS.MI-1 - Incident Mitigation

🟡 ISO 27001:2022

A.5.15 - Access Control A.6.1.1 - Information Security Policies A.8.2.1 - User Endpoint Devices A.12.2.1 - Restrictions on Software Installation A.12.6.1 - Management of Technical Vulnerabilities A.14.2.1 - Secure Development Policy

🟣 PCI DSS v4.0.1

Requirement 1 - Firewall Configuration Requirement 2 - Default Passwords Requirement 6 - Secure Development Requirement 10 - Logging and Monitoring

🔗 References & Sources 3

🔗

https://github.com/dataease/dataease/releases/tag/v2.10.21

security-advisories@github.com

Release Notes

🔗

https://github.com/dataease/dataease/security/advisories/GHSA-pgh3-rgw3-xjmm

security-advisories@github.com

Exploit Third Party Advisory

🔗

https://github.com/dataease/dataease/security/advisories/GHSA-pgh3-rgw3-xjmm

134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit Third Party Advisory

📦 Affected Products / CPE 1 entries

dataease:dataease

📊 CVSS Score

8.8

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityH — High

📋 Quick Facts

Severity High

CVSS Score8.8

CWECWE-89

EPSS0.03%

Exploit ✓ Yes

Patch ✗ No

Published 2026-04-16

Source Feed nvd

🇸🇦 Saudi Risk Score

8.2

/ 10.0 — Saudi Risk

Priority: CRITICAL

🏷️ Tags

exploit-available CWE-89

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-33207

💬 Comments

Introduce Yourself

Sign In Required