PT-2025-27412 · Dataease · Dataease

For-A1Kaid + 2 · Published 2025-06-30 · Updated 2025-07-16 · CVE-2025-53005

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.11

Description: DataEase is an open source business intelligence and data visualization tool. There is a bypass vulnerability in DataEase's PostgreSQL Data Source JDBC Connection Parameters. The sslfactory and sslfactoryarg parameters could trigger a bypass vulnerability. This issue has been patched in version 2.10.11.

Recommendations: For versions prior to 2.10.11, update to version 2.10.11 to resolve the issue. As a temporary workaround, consider restricting the use of the sslfactory and sslfactoryarg parameters in the PostgreSQL Data Source JDBC Connection Parameters until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-153

Related Identifiers

CVE-2025-53005

GHSA-99C4-H4FQ-R23V

Affected Products

Dataease

References · 11

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-99c4-h4fq-r23v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53005.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-53005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53005 · Security Note
• https://twitter.com/CveFindCom/status/1939854220494094530 · Twitter Post
• https://t.me/cvetracker/27476 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1939541448719811015 · Twitter Post
• https://twitter.com/jmdevlabs/status/1945142872732225575 · Twitter Post
• https://twitter.com/CVEnew/status/1939886097309335903 · Twitter Post
• https://t.me/cvenotify/127195 · Telegram Post
• https://t.me/cvenotify/129177 · Telegram Post