PT-2025-36428 · Datart · Datart

147369.Yjk · Published 2025-09-08 · Updated 2025-09-08 · CVE-2025-10080

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Datart versions up to 1.0.0-rc3

Description A vulnerability exists in Datart due to the use of a hard-coded cryptographic key within the getTokensecret function located in the datart/security/src/main/java/datart/security/util/AESUtil.java file of the API component. The issue is remotely exploitable and considered to have high complexity, though exploitation is difficult. The exploit has been publicly disclosed.

Recommendations Versions prior to 1.0.0-rc3: As a temporary workaround, consider restricting access to the getTokensecret function until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-321

CWE-320

Related Identifiers

CVE-2025-10080

Affected Products

Datart

References · 8

• 🔥 https://github.com/yjk12/Elephant-Datart-/tree/main · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10080 · Security Note
• https://vuldb.com/?ctiid.323028 · Note
• https://t.me/cveNotify/134586 · Telegram Post
• https://twitter.com/CVEnew/status/1964900051219878359 · Twitter Post
• https://vuldb.com/?id.323028 · Note
• https://vuldb.com/?submit.644631 · Note
• https://t.me/CVEtracker/31929 · Telegram Post