by Kastro
Paper/Archive/CVE-2025-64164

CVE-2025-64164

dataease dataease — DataEase is vulnerable to Oracle JNDI Injection

EPSS 0.6%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 49.9.499 × 2010.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishing JDBC connections to Oracle, resulting in a risk of JNDI injection (Java Naming and Directory Interface injection). This issue is fixed in version 2.10.15.

Affected

ProductAffectedFixed inSource
dataease< 2.10.15–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)8.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/dataease/dataease/security/advisories/GHSA-q754-4pc2-wjqwrefgithub.com/dataease/dataease/commit/7b68eb3dfccbbd12ec977e6320dbd3e32a7bbfe6refgithub.com/dataease/dataease/releases/tag/v2.10.15