PT-2026-26550 · Dataease · Dataease
Fushuling
+1
·
Publicado
2026-03-20
·
Atualizado
2026-03-24
·
CVE-2026-32939
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
DataEase versions 2.10.19 and below
Description
DataEase is an open source data visualization analysis tool. Versions 2.10.19 and below exhibit inconsistent locale handling between the JDBC URL validation logic and the H2 JDBC engine's internal parsing. DataEase uses
String.toUpperCase() without specifying an explicit locale, relying on the JVM's default runtime locale for security checks, while H2 JDBC normalizes URLs using Locale.ENGLISH. In Turkish locale environments (tr TR), Java converts the lowercase letter 'i' to 'İ' (dotted capital I) instead of 'I', allowing a malicious parameter like iNIT to bypass DataEase's blacklist while H2 correctly interprets it as INIT. This discrepancy enables attackers to smuggle dangerous JDBC parameters past DataEase's security validation. The issue has been confirmed as exploitable in real-world DataEase deployments running under affected regional settings.Recommendations
Update DataEase to version 2.10.20 or later.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Dataease