PT-2025-37719 · Dataease+1 · Dataease+1

Fit2Cloudrd · Published 2025-09-15 · Updated 2025-10-24 · CVE-2025-58045

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dataease versions up to 2.10.12

Description Dataease is an open source data analytics and visualization platform. A patch intended to mitigate DB2 JDBC deserialization remote code execution attacks only blacklisted the rmi parameter. The ldap parameter in the DB2 JDBC connection string was not filtered, allowing attackers to exploit the DB2 JDBC connection string to trigger server-side request forgery (SSRF). While higher versions of Java disable ldap deserialization by default, preventing remote code execution, SSRF remains exploitable.

Recommendations Update to version 2.10.13 or later.

Exploit

Fix

RCE

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-58045

GHSA-FMQ3-6XHC-R845

Affected Products

Db2 Jdbc

Dataease

References · 11

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-fmq3-6xhc-r845 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58045.json · Exploit
• https://github.com/dataease/dataease/commit/77078658715bd85af5867afbfd5f1fcc37cf03c8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-58045 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58045 · Vendor Advisory
• https://t.me/cveNotify/139229 · Telegram Post
• https://t.me/CVEtracker/32530 · Telegram Post
• https://t.me/cveNotify/135501 · Telegram Post
• https://t.me/CVEtracker/35205 · Telegram Post
• https://t.me/cveNotify/140235 · Telegram Post
• https://twitter.com/CVEnew/status/1969482354965299586 · Twitter Post