Vulnerability · Published Mar 13, 2025 · Assigned by GitHub_M
CVE-2025-27103Dataease Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability
High 7.3
In plain English
A high-severity SQL injection in dataease from dataease. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 4.0)7.3High
Exploit odds (30 days)0.5%top 60.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the patch for CVE-2024-55953 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available.
Affected products (as reported)
Weakness: CWE-89, CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
References
- https://github.com/dataease/dataease/security/advisories/GHSA-v4gg-8rp3-ccjx x_refsource_CONFIRM