PT-2025-23658 · Dataease · Dataease

Ph0Ebus · Published 2025-06-03 · Updated 2025-06-03 · CVE-2025-48998

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.10 DataEase version 2.10.6 through 2.10.9

Description The issue allows authenticated users to read and deserialize arbitrary files through the background JDBC connection due to a bypass of a previous patch.

Recommendations For versions prior to 2.10.10, update to version 2.10.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the background JDBC connection until a patch is available.

Exploit

Fix

Missing Authorization

SQL injection

Weakness Enumeration

CWE-862

CWE-89

Related Identifiers

CVE-2025-48998

GHSA-2WFC-QWX7-W692

GHSA-V4GG-8RP3-CCJX

Affected Products

Dataease

References · 8

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-2wfc-qwx7-w692 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48998.json · Exploit
• https://github.com/dataease/dataease/security/advisories/GHSA-v4gg-8rp3-ccjx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48998 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48998 · Security Note
• https://twitter.com/CVEnew/status/1929974161255829658 · Twitter Post
• https://t.me/cvetracker/25313 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1930031802317406605 · Twitter Post