PT-2025-18683

CVE-2025-46566

Published

2025-05-01

Updated

2025-06-03

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.9

Description DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.9, authenticated users can complete Remote Code Execution (RCE) through the backend JDBC link. This issue has been patched in version 2.10.9.

Recommendations For versions prior to 2.10.9, update to version 2.10.9 to resolve the issue. As a temporary workaround, consider restricting access to the backend JDBC link until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Drun1Baby

H3H3Qaq

Hack-Umbrella

Vendors

Affected products

Weakness enumeration

CWE-923: Improper Restriction of Communication Channel to Intended Endpoints