CVE-2025-57772

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-57772
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's filtering logic and returns the H2 JDBC URL, allowing the "driver":"org.h2.Driver" to specify the H2 driver for the JDBC connection. The vulnerability has been fixed in version 2.10.12.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/dataease/dataease/commit/1644d81dff46272b09570fa1f4a8f83f01f37440 Patch
https://github.com/dataease/dataease/security/advisories/GHSA-v37q-vh67-9rqv Third Party Advisory Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*
History

03 Sep 2025, 13:41

Type Values Removed Values Added
First Time Dataease dataease
Dataease
References () https://github.com/dataease/dataease/commit/1644d81dff46272b09570fa1f4a8f83f01f37440 - () https://github.com/dataease/dataease/commit/1644d81dff46272b09570fa1f4a8f83f01f37440 - Patch
References () https://github.com/dataease/dataease/security/advisories/GHSA-v37q-vh67-9rqv - () https://github.com/dataease/dataease/security/advisories/GHSA-v37q-vh67-9rqv - Third Party Advisory, Exploit
CPE cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
Summary
  • (es) DataEase es una herramienta de código abierto para inteligencia empresarial y visualización de datos. Antes de la versión 2.10.12, DataEase incluía una omisión de RCE JDBC H2. Si la URL JDBC cumple los criterios, se devuelve el método getJdbcUrl, que actúa como captador del parámetro JdbcUrl proporcionado. Esto omite la lógica de filtrado de H2 y devuelve la URL JDBC H2, lo que permite que "driver":"org.h2.Driver" especifique el controlador H2 para la conexión JDBC. Esta vulnerabilidad se ha corregido en la versión 2.10.12.

25 Aug 2025, 20:24

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-25 17:15

Updated : 2025-09-03 13:41

NVD link : CVE-2025-57772

Mitre link : CVE-2025-57772

CVE.ORG link : CVE-2025-57772

JSON object : View

Products Affected

dataease

  • dataease
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')