PT-2025-47466 · Progress · Progress Datadirect Connect For Jdbc For Sap S/4 Hana+31

Brecht Snijders · Published 2025-11-19 · Updated 2025-11-22 · CVE-2025-10702

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Progress DataDirect Connect for JDBC for Amazon Redshift versions through 6.0.0.001392 Progress DataDirect Connect for JDBC for Apache Cassandra versions through 6.0.0.000805 Progress DataDirect Connect for JDBC for Hive versions through 6.0.1.001499 Progress DataDirect Connect for JDBC for Apache Impala versions through 6.0.0.001155 Progress DataDirect Connect for JDBC for Apache SparkSQL versions through 6.0.1.001222 Progress DataDirect Connect for JDBC Autonomous REST Connector versions through 6.0.1.006961 Progress DataDirect Connect for JDBC for DB2 versions through 6.0.0.000717 Progress DataDirect Connect for JDBC for Google Analytics 4 versions through 6.0.0.000454 Progress DataDirect Connect for JDBC for Google BigQuery versions through 6.0.0.002279 Progress DataDirect Connect for JDBC for Greenplum versions through 6.0.0.001712 Progress DataDirect Connect for JDBC for Informix versions through 6.0.0.000690 Progress DataDirect Connect for JDBC for Microsoft Dynamics 365 versions through 6.0.0.003161 Progress DataDirect Connect for JDBC for Microsoft SQLServer versions through 6.0.0.001936 Progress DataDirect Connect for JDBC for Microsoft Sharepoint versions through 6.0.0.001559 Progress DataDirect Connect for JDBC for MongoDB versions through 6.1.0.001654 Progress DataDirect Connect for JDBC for MySQL versions through 5.1.4.000330 Progress DataDirect Connect for JDBC for Oracle Database versions through 6.0.0.001747 Progress DataDirect Connect for JDBC for Oracle Eloqua versions through 6.0.0.001438 Progress DataDirect Connect for JDBC for Oracle Sales Cloud versions through 6.0.0.001225 Progress DataDirect Connect for JDBC for Oracle Service Cloud versions through 5.1.4.000298 Progress DataDirect Connect for JDBC for PostgreSQL versions through 6.0.0.001843 Progress DataDirect Connect for JDBC for Progress OpenEdge versions through 5.1.4.000187 Progress DataDirect Connect for JDBC for Salesforce versions through 6.0.0.003020 Progress DataDirect Connect for JDBC for SAP HANA versions through 6.0.0.000879 Progress DataDirect Connect for JDBC for SAP S/4 HANA versions through 6.0.1.001818 Progress DataDirect Connect for JDBC for Sybase ASE versions through 5.1.4.000161 Progress DataDirect Connect for JDBC for Snowflake versions through 6.0.1.001821 DataDirect Hybrid Data Pipeline Server versions through 4.6.2.3309 DataDirect Hybrid Data Pipeline JDBC Driver versions through 4.6.2.0607 DataDirect Hybrid Data Pipeline On Premises Connector versions through 4.6.2.1223 DataDirect Hybrid Data Pipeline Docker versions through 4.6.2.3316 DataDirect OpenAccess JDBC Driver versions through 8.1.0.0177 DataDirect OpenAccess JDBC Driver versions through 9.0.0.0019

Description The software is susceptible to a code injection issue due to improper control of code generation. The SpyAttribute connection option allows an attacker to load and execute arbitrary classes on the class path if the application permits user-specified values for this option. This can lead to remote code inclusion.

Recommendations Progress DataDirect Connect for JDBC for Amazon Redshift versions through 6.0.0.001392: Upgrade to version 6.0.0.001541 or later. Progress DataDirect Connect for JDBC for Apache Cassandra versions through 6.0.0.000805: Upgrade to version 6.0.0.000833 or later. Progress DataDirect Connect for JDBC for Hive versions through 6.0.1.001499: Upgrade to version 6.0.1.001628 or later. Progress DataDirect Connect for JDBC for Apache Impala versions through 6.0.0.001155: Upgrade to version 6.0.0.001279 or later. Progress DataDirect Connect for JDBC for Apache SparkSQL versions through 6.0.1.001222: Upgrade to version 6.0.1.001344 or later. Progress DataDirect Connect for JDBC Autonomous REST Connector versions through 6.0.1.006961: Upgrade to version 6.0.1.007063 or later. Progress DataDirect Connect for JDBC for DB2 versions through 6.0.0.000717: Upgrade to version 6.0.0.000964 or later. Progress DataDirect Connect for JDBC for Google Analytics 4 versions through 6.0.0.000454: Upgrade to version 6.0.0.000525 or later. Progress DataDirect Connect for JDBC for Google BigQuery versions through 6.0.0.002279: Upgrade to version 6.0.0.002410 or later. Progress DataDirect Connect for JDBC for Greenplum versions through 6.0.0.001712: Upgrade to version 6.0.0.001727 or later. Progress DataDirect Connect for JDBC for Informix versions through 6.0.0.000690: Upgrade to version 6.0.0.0851 or later. Progress DataDirect Connect for JDBC for Microsoft Dynamics 365 versions through 6.0.0.003161: Upgrade to version 6.0.0.3198 or later. Progress DataDirect Connect for JDBC for Microsoft SQLServer versions through 6.0.0.001936: Upgrade to version 6.0.0.001957 or later. Progress DataDirect Connect for JDBC for Microsoft Sharepoint versions through 6.0.0.001559: Upgrade to version 6.0.0.001587 or later. Progress DataDirect Connect for JDBC for MongoDB versions through 6.1.0.001654: Upgrade to version 6.1.0.001669 or later. Progress DataDirect Connect for JDBC for MySQL versions through 5.1.4.000330: Upgrade to version 5.1.4.000364 or later. Progress DataDirect Connect for JDBC for Oracle Database versions through 6.0.0.001747: Upgrade to version 6.0.0.001776 or later. Progress DataDirect Connect for JDBC for Oracle Eloqua versions through 6.0.0.001438: Upgrade to version 6.0.0.001458 or later. Progress DataDirect Connect for JDBC for Oracle Sales Cloud versions through 6.0.0.001225: Upgrade to version 6.0.0.001316 or later. Progress DataDirect Connect for JDBC for Oracle Service Cloud versions through 5.1.4.000298: Upgrade to version 5.1.4.000309 or later. Progress DataDirect Connect for JDBC for PostgreSQL versions through 6.0.0.001843: Upgrade to version 6.0.0.001856 or later. Progress DataDirect Connect for JDBC for Progress OpenEdge versions through 5.1.4.000187: Upgrade to version 5.1.4.000189 or later. Progress DataDirect Connect for JDBC for Salesforce versions through 6.0.0.003020: Upgrade to version 6.0.0.003125 or later. Progress DataDirect Connect for JDBC for SAP HANA versions through 6.0.0.000879: This product is retired. Progress DataDirect Connect for JDBC for SAP S/4 HANA versions through 6.0.1.001818: Upgrade to version 6.0.1.001858 or later. Progress DataDirect Connect for JDBC for Sybase ASE versions through 5.1.4.000161: Upgrade to version 5.1.4.000162 or later. Progress DataDirect Connect for JDBC for Snowflake versions through 6.0.1.001821: Upgrade to version 6.0.1.001856 or later. DataDirect Hybrid Data Pipeline Server versions through 4.6.2.3309: Upgrade to version 4.6.2.3430 or later. DataDirect Hybrid Data Pipeline JDBC Driver versions through 4.6.2.0607: Upgrade to version 4.6.2.1023 or later. DataDirect Hybrid Data Pipeline On Premises Connector versions through 4.6.2.1223: Upgrade to version 4.6.2.1339 or later. DataDirect Hybrid Data Pipeline Docker versions through 4.6.2.3316: Upgrade to version 4.6.2.3430 or later. DataDirect OpenAccess JDBC Driver versions through 8.1.0.0177: Upgrade to version 8.1.0.0183 or later. DataDirect OpenAccess JDBC Driver versions through 9.0.0.0019: Upgrade to version 9.0.0.0022 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-10702

Affected Products

Datadirect Hybrid Data Pipeline Docker

Datadirect Hybrid Data Pipeline Jdbc Driver

Datadirect Hybrid Data Pipeline On Premises Connector

Datadirect Hybrid Data Pipeline Server

Datadirect Openaccess Jdbc Driver

Datadirect Connect For Jdbc Autonomous Rest Connector

Progress Datadirect Connect For Jdbc For Amazon Redshift

Progress Datadirect Connect For Jdbc For Apache Cassandra

Progress Datadirect Connect For Jdbc For Apache Impala

Progress Datadirect Connect For Jdbc For Apache Sparksql

Progress Datadirect Connect For Jdbc For Db2

Datadirect Connect For Jdbc For Google Analytics 4

Progress Datadirect Connect For Jdbc For Google Bigquery

Progress Datadirect Connect For Jdbc For Greenplum

Progress Datadirect Connect For Jdbc For Hive

Progress Datadirect Connect For Jdbc For Informix

Datadirect Connect For Jdbc For Microsoft Dynamics 365

Datadirect Connect For Jdbc For Microsoft Sqlserver

Datadirect Connect For Jdbc For Microsoft Sharepoint

Progress Datadirect Connect For Jdbc For Mongodb

Progress Datadirect Connect For Jdbc For Mysql

Progress Datadirect Connect For Jdbc For Oracle Database

Progress Datadirect Connect For Jdbc For Oracle Eloqua

Datadirect Connect For Jdbc For Oracle Sales Cloud

Datadirect Connect For Jdbc For Oracle Service Cloud

Datadirect Connect For Jdbc For Postgresql

Datadirect Connect For Jdbc For Progress Openedge

Progress Datadirect Connect For Jdbc For Sap Hana

Progress Datadirect Connect For Jdbc For Sap S/4 Hana

Progress Datadirect Connect For Jdbc For Salesforce

Progress Datadirect Connect For Jdbc For Snowflake

Progress Datadirect Connect For Jdbc For Sybase Ase

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10702 · Security Note
• https://t.me/cveNotify/143381 · Telegram Post
• https://twitter.com/CVEnew/status/1991187297841344943 · Twitter Post
• https://community.progress.com/s/article/Progress-DataDirect-Critical-Security-Product-Alert-Bulletin-November-2025 · Note
• https://twitter.com/SecAideInfo/status/1992174855899238611 · Twitter Post