PT-2025-47467 · Datadirect · Datadirect Connect For Jdbc For Google Bigquery+31

Brecht Snijders · Published 2025-11-19 · Updated 2025-11-22 · CVE-2025-10703

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions DataDirect Connect for JDBC for Amazon Redshift versions through 6.0.0.001392 DataDirect Connect for JDBC for Apache Cassandra versions through 6.0.0.000805 DataDirect Connect for JDBC for Hive versions through 6.0.1.001499 DataDirect Connect for JDBC for Apache Impala versions through 6.0.0.001155 DataDirect Connect for JDBC for Apache SparkSQL versions through 6.0.1.001222 DataDirect Connect for JDBC Autonomous REST Connector versions through 6.0.1.006961 DataDirect Connect for JDBC for DB2 versions through 6.0.0.000717 DataDirect Connect for JDBC for Google Analytics 4 versions through 6.0.0.000454 DataDirect Connect for JDBC for Google BigQuery versions through 6.0.0.002279 DataDirect Connect for JDBC for Greenplum versions through 6.0.0.001712 DataDirect Connect for JDBC for Informix versions through 6.0.0.000690 DataDirect Connect for JDBC for Microsoft Dynamics 365 versions through 6.0.0.003161 DataDirect Connect for JDBC for Microsoft SQLServer versions through 6.0.0.001936 DataDirect Connect for JDBC for Microsoft Sharepoint versions through 6.0.0.001559 DataDirect Connect for JDBC for MongoDB versions through 6.1.0.001654 DataDirect Connect for JDBC for MySQL versions through 5.1.4.000330 DataDirect Connect for JDBC for Oracle Database versions through 6.0.0.001747 DataDirect Connect for JDBC for Oracle Eloqua versions through 6.0.0.001438 DataDirect Connect for JDBC for Oracle Sales Cloud versions through 6.0.0.001225 DataDirect Connect for JDBC for Oracle Service Cloud versions through 5.1.4.000298 DataDirect Connect for JDBC for PostgreSQL versions through 6.0.0.001843 DataDirect Connect for JDBC for Progress OpenEdge versions through 5.1.4.000187 DataDirect Connect for JDBC for Salesforce versions through 6.0.0.003020 DataDirect Connect for JDBC for SAP HANA versions through 6.0.0.000879 DataDirect Connect for JDBC for SAP S/4 HANA versions through 6.0.1.001818 DataDirect Connect for JDBC for Sybase ASE versions through 5.1.4.000161 DataDirect Connect for JDBC for Snowflake versions through 6.0.1.001821 DataDirect Hybrid Data Pipeline Server versions through 4.6.2.3309 DataDirect Hybrid Data Pipeline JDBC Driver versions through 4.6.2.0607 DataDirect Hybrid Data Pipeline On Premises Connector versions through 4.6.2.1223 DataDirect Hybrid Data Pipeline Docker versions through 4.6.2.3316 DataDirect OpenAccess JDBC Driver versions through 8.1.0.0177 DataDirect OpenAccess JDBC Driver versions through 9.0.0.0019

Description The software contains an Improper Control of Generation of Code issue, specifically a Code Injection flaw. The SpyAttribute connection option, used with the log=(file) construct, allows a user to specify an arbitrary file for the JDBC driver to write log information to. If an application permits a user to define a value for the SpyAttributes connection option, an attacker could potentially write JavaScript code to a log file. If this log file is located in a directory accessible by the application server and has the correct extension, the server might interpret it as a resource to be served. An attacker could then request this resource, leading to the execution of the injected JavaScript code.

Recommendations For DataDirect Connect for JDBC for Amazon Redshift versions through 6.0.0.001392, upgrade to version 6.0.0.001541. For DataDirect Connect for JDBC for Apache Cassandra versions through 6.0.0.000805, upgrade to version 6.0.0.000833. For DataDirect Connect for JDBC for Hive versions through 6.0.1.001499, upgrade to version 6.0.1.001628. For DataDirect Connect for JDBC for Apache Impala versions through 6.0.0.001155, upgrade to version 6.0.0.001279. For DataDirect Connect for JDBC for Apache SparkSQL versions through 6.0.1.001222, upgrade to version 6.0.1.001344. For DataDirect Connect for JDBC Autonomous REST Connector versions through 6.0.1.006961, upgrade to version 6.0.1.007063. For DataDirect Connect for JDBC for DB2 versions through 6.0.0.000717, upgrade to version 6.0.0.000964. For DataDirect Connect for JDBC for Google Analytics 4 versions through 6.0.0.000454, upgrade to version 6.0.0.000525. For DataDirect Connect for JDBC for Google BigQuery versions through 6.0.0.002279, upgrade to version 6.0.0.002410. For DataDirect Connect for JDBC for Greenplum versions through 6.0.0.001712, upgrade to version 6.0.0.001727. For DataDirect Connect for JDBC for Informix versions through 6.0.0.000690, upgrade to version 6.0.0.0851. For DataDirect Connect for JDBC for Microsoft Dynamics 365 versions through 6.0.0.003161, upgrade to version 6.0.0.3198. For DataDirect Connect for JDBC for Microsoft SQLServer versions through 6.0.0.001936, upgrade to version 6.0.0.001957. For DataDirect Connect for JDBC for Microsoft Sharepoint versions through 6.0.0.001559, upgrade to version 6.0.0.001587. For DataDirect Connect for JDBC for MongoDB versions through 6.1.0.001654, upgrade to version 6.1.0.001669. For DataDirect Connect for JDBC for MySQL versions through 5.1.4.000330, upgrade to version 5.1.4.000364. For DataDirect Connect for JDBC for Oracle Database versions through 6.0.0.001747, upgrade to version 6.0.0.001776. For DataDirect Connect for JDBC for Oracle Eloqua versions through 6.0.0.001438, upgrade to version 6.0.0.001458. For DataDirect Connect for JDBC for Oracle Sales Cloud versions through 6.0.0.001225, upgrade to version 6.0.0.001316. For DataDirect Connect for JDBC for Oracle Service Cloud versions through 5.1.4.000298, upgrade to version 5.1.4.000309. For DataDirect Connect for JDBC for PostgreSQL versions through 6.0.0.001843, upgrade to version 6.0.0.001856. For DataDirect Connect for JDBC for Progress OpenEdge versions through 5.1.4.000187, upgrade to version 5.1.4.000189. For DataDirect Connect for JDBC for Salesforce versions through 6.0.0.003020, upgrade to version 6.0.0.003125. For DataDirect Connect for JDBC for SAP HANA versions through 6.0.0.000879, this product is retired. For DataDirect Connect for JDBC for SAP S/4 HANA versions through 6.0.1.001818, upgrade to version 6.0.1.001858. For DataDirect Connect for JDBC for Sybase ASE versions through 5.1.4.000161, upgrade to version 5.1.4.000162. For DataDirect Connect for JDBC for Snowflake versions through 6.0.1.001821, upgrade to version 6.0.1.001856. For DataDirect Hybrid Data Pipeline Server versions through 4.6.2.3309, upgrade to version 4.6.2.3430. For DataDirect Hybrid Data Pipeline JDBC Driver versions through 4.6.2.0607, upgrade to version 4.6.2.1023. For DataDirect Hybrid Data Pipeline On Premises Connector versions through 4.6.2.1223, upgrade to version 4.6.2.1339. For DataDirect Hybrid Data Pipeline Docker versions through 4.6.2.3316, upgrade to version 4.6.2.3430. For DataDirect OpenAccess JDBC Driver versions through 8.1.0.0177, upgrade to version 8.1.0.0183. For DataDirect OpenAccess JDBC Driver versions through 9.0.0.0019, upgrade to version 9.0.0.0022.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-10703

Affected Products

Datadirect Connect For Jdbc Autonomous Rest Connector

Datadirect Connect For Jdbc For Amazon Redshift

Datadirect Connect For Jdbc For Apache Cassandra

Datadirect Connect For Jdbc For Apache Impala

Datadirect Connect For Jdbc For Apache Sparksql

Datadirect Connect For Jdbc For Db2

Datadirect Connect For Jdbc For Google Analytics 4

Datadirect Connect For Jdbc For Google Bigquery

Datadirect Connect For Jdbc For Greenplum

Datadirect Connect For Jdbc For Hive

Datadirect Connect For Jdbc For Informix

Datadirect Connect For Jdbc For Microsoft Dynamics 365

Datadirect Connect For Jdbc For Microsoft Sqlserver

Datadirect Connect For Jdbc For Microsoft Sharepoint

Datadirect Connect For Jdbc For Mongodb

Datadirect Connect For Jdbc For Mysql

Datadirect Connect For Jdbc For Oracle Database

Datadirect Connect For Jdbc For Oracle Eloqua

Datadirect Connect For Jdbc For Oracle Sales Cloud

Datadirect Connect For Jdbc For Oracle Service Cloud

Datadirect Connect For Jdbc For Postgresql

Datadirect Connect For Jdbc For Progress Openedge

Datadirect Connect For Jdbc For Sap Hana

Datadirect Connect For Jdbc For Sap S/4 Hana

Datadirect Connect For Jdbc For Salesforce

Datadirect Connect For Jdbc For Snowflake

Datadirect Connect For Jdbc For Sybase Ase

Datadirect Hybrid Data Pipeline Docker

Datadirect Hybrid Data Pipeline Jdbc Driver

Datadirect Hybrid Data Pipeline On Premises Connector

Datadirect Hybrid Data Pipeline Server

Datadirect Openaccess Jdbc Driver

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10703 · Security Note
• https://t.me/cveNotify/143382 · Telegram Post
• https://community.progress.com/s/article/Progress-DataDirect-Critical-Security-Product-Alert-Bulletin-November-2025 · Note
• https://twitter.com/CVEnew/status/1991187296784380036 · Twitter Post
• https://twitter.com/SecAideInfo/status/1992174847011496053 · Twitter Post