CVE-2025-53006highCWE-153

CVE-2025-53006: fallo de gravedad alta en dataease

Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability

Publicada el

Seguir esta CVE+ Monitorear dataease

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.9epss 0.6%
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference lies in that "sslfactory" and related parameters need to be triggered after establishing the connection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassName". This issue has been patched in 2.10.11.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Productos afectados
dataease · dataease
CVEs relacionadas — dataease

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-49002HIGHDataease H2 Database Remote Code Execution (RCE) Bypass VulnerabilityEPSS 50.7%CVE-2024-56511CRITICALDataEase has an unauthorized vulnerabilityEPSS 50.3%CVE-2025-49001HIGHDataease Authentication Bypass VulnerabilityEPSS 23.1%CVE-2024-30269MEDIUMDataEase has database configuration information exposure vulnerabilityEPSS 15.9%CVE-2025-48999MEDIUMDataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE VulnerabilityEPSS 11.2%CVE-2025-57772HIGHDataease H2 JDBC RCE BypassEPSS 10.9%