PT-2025-42626 · Dataease · Dataease

Published 2025-10-17 · Updated 2025-10-24 · CVE-2025-62419

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions DataEase versions through 2.10.13

Description DataEase is a data visualization and analytics platform. A JDBC URL injection vulnerability exists in the DB2 and MongoDB data sources. The issue allows for potential unauthorized access or manipulation of data through crafted JDBC URLs.

Recommendations Update DataEase to a version later than 2.10.13.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-62419

GHSA-X4X9-MJCF-99R9

Affected Products

Dataease

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62419.json · Exploit
• https://github.com/dataease/dataease/security/advisories/GHSA-x4x9-mjcf-99r9 · Vendor Advisory
• https://github.com/dataease/dataease/commit/bb320e42bf2cf862b9c4b438c1517547b53ed67b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62419 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62419 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1979269083297091973 · Twitter Post
• https://t.me/cveNotify/139229 · Telegram Post
• https://t.me/cveNotify/140235 · Telegram Post
• https://t.me/CVEtracker/35205 · Telegram Post
• https://twitter.com/CVEnew/status/1979289026239594690 · Twitter Post