PT-2025-45170 · Dataease+1 · Dataease+1

Published 2025-11-06 · Updated 2025-11-11 · CVE-2025-64164

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dataease versions 2.10.14 and below

Description Dataease is an open source data visualization analysis tool. Versions 2.10.14 and below do not properly filter when establishing JDBC connections to Oracle, which can lead to a Java Naming and Directory Interface (JNDI) injection. JNDI is a Java API for looking up data and objects through a naming service.

Recommendations Update to version 2.10.15 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-64164

GHSA-Q754-4PC2-WJQW

Affected Products

Dataease

Oracle

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64164.json · Exploit
• https://github.com/dataease/dataease/commit/7b68eb3dfccbbd12ec977e6320dbd3e32a7bbfe6 · Patch
• https://github.com/dataease/dataease/security/advisories/GHSA-q754-4pc2-wjqw · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-64164 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64164 · Vendor Advisory
• https://github.com/dataease/dataease/releases/tag/v2.10.15 · Note
• https://t.me/cveNotify/141888 · Telegram Post
• https://t.me/CVEtracker/36657 · Telegram Post
• https://twitter.com/cracbot/status/1988200074095239512 · Twitter Post