PT-2025-37720 · Dataease · Dataease

Gsbp0 · Published 2025-09-15 · Updated 2025-09-20 · CVE-2025-58046

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dataease versions prior to 2.10.13 Dataease versions 2.10.12 and earlier

Description Dataease is a data visualization and analysis platform. Versions up to and including 2.10.12 are susceptible to remote code execution through the Impala data source. Insufficient filtering in the getJdbc method of the io.dataease.datasource.type.Impala class allows attackers to construct malicious JDBC connection strings. This exploits JNDI injection and triggers RMI deserialization, potentially leading to remote command execution. The vulnerability is exploitable by modifying the data source and providing a crafted JDBC connection string referencing a remote configuration file, resulting in RMI-based deserialization attacks.

Recommendations Upgrade to Dataease version 2.10.13 or later.

Exploit

Fix

RCE

Special Elements Injection

Deserialization of Untrusted Data

Weakness Enumeration

CWE-74

CWE-502

Related Identifiers

CVE-2025-58046

GHSA-MVWC-X8X9-46C3

Affected Products

Dataease

References · 9

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-mvwc-x8x9-46c3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58046.json · Exploit
• https://github.com/dataease/dataease/commit/8d04e92d44e1bac9284e9e64df5afd7f96d9373c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-58046 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58046 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1967621794086396395 · Twitter Post
• https://t.me/CVEtracker/32531 · Telegram Post
• https://t.me/cveNotify/135502 · Telegram Post
• https://twitter.com/CVEnew/status/1969482353727946809 · Twitter Post