PT-2025-17642 · Dataease · Dataease

N1Etzsche0 · Published 2025-04-23 · Updated 2025-06-04 · CVE-2025-32966

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.8

Description The issue allows authenticated users to complete remote code execution (RCE) through the backend JDBC link.

Recommendations For versions prior to 2.10.8, update to version 2.10.8 to resolve the issue. As a temporary workaround, consider restricting access to the backend JDBC link until the update is applied.

Exploit

Fix

RCE

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-32966

GHSA-H7HJ-4J78-CVC7

Affected Products

Dataease

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32966.json · Exploit
• https://github.com/dataease/dataease/security/advisories/GHSA-h7hj-4j78-cvc7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32966 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32966 · Vendor Advisory
• https://t.me/cvetracker/25326 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1930088113323332056 · Twitter Post
• https://twitter.com/CVEnew/status/1915067228564697258 · Twitter Post
• https://twitter.com/CVEnew/status/1930004332025384965 · Twitter Post
• https://t.me/cvetracker/22205 · Telegram Post