The vulnerability allows an authenticated attacker to inject arbitrary SQL code through the sort parameter of the /de2api/datasetData/enumValueObj endpoint. This leads to a time-based blind SQL injection in the underlying CalciteProvider, giving attackers potential to read or modify data stored in the database. The weakness is a classic SQL injection scenario (CWE-89).

DataEase, an open-source data visualization and analytics platform. Versions 2.10.20 and earlier are affected. The issue was fixed in version 2.10.21.

The CVSS score of 8.7 classifies this as a high severity vulnerability. No EPSS score is available, so the likelihood of exploitation is unknown, but it is not listed in CISA's Known Exploited Vulnerabilities catalog. The vulnerability requires authentication to the system, meaning that privileged users or authenticated API clients can exploit it. Attackers can deliver malicious sort strings that are incorporated directly into an ORDER BY clause, enabling data extraction or modification through injection.