by Kastro
Paper/Archive/CVE-2025-27138

CVE-2025-27138

dataease dataease — DataEase has an improper authentication vulnerability

EPSS 0.6%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 48.1.481 × 209.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access. The vulnerability has been fixed in v2.10.6. No known workarounds are available.

Affected

ProductAffectedFixed inSource
dataease< 2.10.6–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)7.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refgithub.com/dataease/dataease/security/advisories/GHSA-533g-whf8-q637