CVE-2025-49001highCWE-287

CVE-2025-49001: high-severity vulnerability in dataease

Dataease Authentication Bypass Vulnerability

Published · Updated

Follow this CVE+ Monitor dataease

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.7epss 22%
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No known workarounds are available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
dataease · dataease
Related CVEs — dataease

In the same product, most dangerous first.

CVE-2025-49002HIGHDataease H2 Database Remote Code Execution (RCE) Bypass VulnerabilityEPSS 50.4%CVE-2024-56511CRITICALDataEase has an unauthorized vulnerabilityEPSS 50.3%CVE-2024-30269MEDIUMDataEase has database configuration information exposure vulnerabilityEPSS 15.9%CVE-2025-57772HIGHDataease H2 JDBC RCE BypassEPSS 10.9%CVE-2025-48999MEDIUMDataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE VulnerabilityEPSS 10.4%CVE-2025-57773HIGHDataease DB2 Aspectweaver Deserialization Arbitrary File Write VulnerabilityEPSS 9.7%