CVE-2024-55953highCWE-89

CVE-2024-55953: high-severity vulnerability in dataease

Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability

Published

Follow this CVE+ Monitor dataease

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 1.0%
DataEase is an open source business analytics tool. Authenticated users can read and deserialize arbitrary files through the background JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. This vulnerability has been fixed in v1.18.27. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
dataease · dataease
Related CVEs — dataease

In the same product, most dangerous first.

CVE-2025-49002HIGHDataease H2 Database Remote Code Execution (RCE) Bypass VulnerabilityEPSS 50.4%CVE-2024-56511CRITICALDataEase has an unauthorized vulnerabilityEPSS 50.3%CVE-2025-49001HIGHDataease Authentication Bypass VulnerabilityEPSS 22.0%CVE-2024-30269MEDIUMDataEase has database configuration information exposure vulnerabilityEPSS 15.9%CVE-2025-57772HIGHDataease H2 JDBC RCE BypassEPSS 10.9%CVE-2025-48999MEDIUMDataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE VulnerabilityEPSS 10.4%