PT-2025-18683 · Dataease · Dataease

Drun1Baby + 2 · Publicado 2025-05-01 · Atualizado 2025-06-03 · CVE-2025-46566

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.9

Description DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.9, authenticated users can complete Remote Code Execution (RCE) through the backend JDBC link. This issue has been patched in version 2.10.9.

Recommendations For versions prior to 2.10.9, update to version 2.10.9 to resolve the issue. As a temporary workaround, consider restricting access to the backend JDBC link until the update is applied.

Exploit

Correção

RCE

Improper Access Control

Enumeração de Fraquezas

CWE-284

CWE-923

Identificadores relacionados

CVE-2025-46566

GHSA-HXW4-VPFP-FRGV

Produtos afetados

Dataease

Referências · 10

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-hxw4-vpfp-frgv · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46566.json · Exploit
• https://t.me/cvenotify/120677 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1918014594045403354 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1918114131774734680 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-46566 · Aviso do Fabricante
• https://t.me/cvetracker/25323 · Publicação no Telegram
• https://t.me/cvetracker/22854 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1930004333816373589 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-46566 · Nota de Segurança