CVE-2025-53006highCWE-153

CVE-2025-53006: high-severity vulnerability in dataease

Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability

Published

Follow this CVE+ Monitor dataease

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.9epss 0.6%
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference lies in that "sslfactory" and related parameters need to be triggered after establishing the connection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassName". This issue has been patched in 2.10.11.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
dataease · dataease
Related CVEs — dataease

In the same product, most dangerous first.

CVE-2025-49002HIGHDataease H2 Database Remote Code Execution (RCE) Bypass VulnerabilityEPSS 50.7%CVE-2024-56511CRITICALDataEase has an unauthorized vulnerabilityEPSS 50.3%CVE-2025-49001HIGHDataease Authentication Bypass VulnerabilityEPSS 23.1%CVE-2024-30269MEDIUMDataEase has database configuration information exposure vulnerabilityEPSS 15.9%CVE-2025-48999MEDIUMDataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE VulnerabilityEPSS 11.2%CVE-2025-57772HIGHDataease H2 JDBC RCE BypassEPSS 10.9%