DataEase CVE-2025-62419

Attacker must be able to create or edit a DB2 or MongoDB data source in DataEase (versions through 2.10.13). For the DB2 path specifically, the extraParams field must be EMPTY - that triggers the vulnerable branch where HOSTNAME/PORT/DATABASE are concatenated into the JDBC URL before the illegal-parameter filter runs, letting a crafted JDBC string in the HOSTNAME field slip through (the fix in 2.10.14 moves the filter to run on the final URL in all branches). Limiting factors: realistically requires authenticated access to the datasource configuration UI/API (despite the CVSS PR:N claim), the DB2 empty-extraParams precondition (reflected as AT:P in the vector), and an affected version ≤2.10.13; the MongoDB handler is affected via the analogous hostName URL-type path. No workaround exists other than upgrading.

This is a genuine, patch-worthy vulnerability but sits below the top tier of urgency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 8.2 (HIGH) and notably rates impact as integrity-only (VC:N/VI:H/VA:N), which undercuts the usual 'JDBC injection = full RCE' assumption - yet the CWE-502 (deserialization) classification implies code-execution potential that the integrity-only scoring does not fully capture; these two signals conflict and the real impact ceiling should be verified against the GHSA advisory. No EPSS score, CISA KEV listing, or POC flag was provided, so there is no evidence of active exploitation - status is 'no public exploit identified at time of analysis.' However, this flaw is explicitly a BYPASS of the previously patched CVE-2025-57773 and CVE-2025-58045, meaning the underlying JDBC-injection technique and prior public research already exist, lowering the barrier to weaponization relative to a brand-new bug. A second conflict: the CVSS vector states PR:N (unauthenticated), but creating/editing a DB2 or MongoDB data source is normally an authenticated, privileged console function - this discrepancy should be verified with the vendor, as it materially changes real-world exposure. Net: prioritize patching for internet-exposed DataEase instances, but this is not a mass-exploitation 'patch tonight' emergency on current evidence.

An attacker with access to the DataEase data-source configuration creates a DB2 (or MongoDB) data source, leaving the extraParams field empty so the HOSTNAME/PORT/DATABASE values are concatenated straight into the JDBC URL without illegal-parameter filtering. They inject a malicious JDBC connection string into the HOSTNAME field - reintroducing the attack blocked by the earlier CVE-2025-57773/58045 patches - to reach dangerous JDBC/driver properties that enable deserialization. No public exploit is identified at time of analysis, but because this is a documented bypass of two prior patches the technique is effectively already in the open.