CVE-2025-62419

Katalog CVE

CVSS 7.5 · High EPSS 0,43%

Kerentanan Deserialization of Untrusted Data pada dataease. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vulnerability exists in the DB2 and MongoDB data source configuration handlers. In the DB2 data source handler, when the extraParams field is empty, the HOSTNAME, PORT, and DATABASE values are directly concatenated into the JDBC URL without filtering illegal parameters. This allows an attacker to inject a malicious JDBC string into the HOSTNAME field to bypass previously patched vulnerabilities CVE-2025-57773 and CVE-2025-58045. The vulnerability is fixed in version 2.10.14. No known workarounds exist.

Rincian

Terbit di NVD

17 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dataease/dataease/security/advisories/GHSA-x4x9-mjcf-99r9 advisory vendor
• https://github.com/dataease/dataease/commit/bb320e42bf2cf862b9c4b438c1517547b53ed67b patch