PT-2025-11211 · Dataease · Dataease
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
DataEase versions prior to 2.10.6
Description:
DataEase is an open source business intelligence and data visualization tool. A patch bypass issue allows authenticated users to read and deserialize arbitrary files through the background JDBC connection.
Recommendations:
For versions prior to 2.10.6, update to version 2.10.6 to resolve the issue.
As a temporary workaround, consider restricting access to the background JDBC connection until the update is applied.
Exploit
Fix
Missing Authorization
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Dataease