-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing Shiro permission checks in the plugin uninstall handler. The fix commit shows: 1) Addition of @RequiresPermissions("plugin:uninstall") to the unInstall method, 2) Database migration adding 'plugin:uninstall' permission entries, and 3) Frontend permission checks. Before 1.11.2, the absence of these controls let non-admin users execute privileged plugin operations via direct API access, matching the CWE-732 (incorrect permission assignment) description.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.dataease:dataease-plugin-common | maven | <= 1.11.1 | 1.11.2 |