DataEase CVE-2025-62420

Requires an authenticated session with privileges to create or configure a data source in DataEase (versions through 2.10.13). The specific trigger is the H2 connection handler's getJdbc logic: validation only checks that jdbcUrl starts with 'jdbc:h2', but the connection actually uses a separate 'jdbc' field - so the attacker sets jdbcUrl='jdbc:h2...' to pass the check while supplying an arbitrary driver and connection string in the jdbc field. Exploitation further depends on the attacker controlling a reachable malicious JDBC driver/endpoint that delivers a deserialization/RCE payload (reflected in the vector's AT:P). Limiting factors: authentication is required per the description, the malicious JDBC infrastructure must be reachable from the server, and patched 2.10.14+ instances enforce validation on the jdbc field itself. No workarounds exist short of upgrading.

This is a credible high-priority issue but not a drive-by. The CVSS 4.0 base score of 8.2 is driven by VI:H (high integrity impact consistent with RCE via a CWE-502 JDBC/deserialization gadget) with VC:N/VA:N, and notably includes AT:P (attack requirements present) - meaning exploitation depends on conditions the attacker must engineer, such as a reachable malicious JDBC driver/endpoint. CONFLICT TO VERIFY: the provided CVSS 4.0 vector states PR:N (no privileges), yet the description explicitly says 'an authenticated attacker' - these disagree, so authentication requirements are not reliably confirmable from the vector alone and the description's 'authenticated' prerequisite should be treated as the operative constraint. A public exploit reference exists (the GHSA advisory), so publicly available exploit code exists, but there is no KEV listing and no EPSS value supplied, so there is no evidence of active, widespread exploitation - this reads as a plausible targeted/post-authentication RCE rather than a mass-exploited internet worm. Net: prioritize patching for any internet-exposed or multi-tenant DataEase instance because authenticated RCE on a BI platform is severe, but the authentication requirement and attacker-controlled-driver precondition materially lower real-world mass-exploitation risk versus the raw score.

An authenticated DataEase user creates or edits an H2 data source, setting jdbcUrl to a benign value beginning with 'jdbc:h2' (which passes the validation check) while placing a malicious driver and connection string in the separate jdbc field that is actually used to connect. When DataEase establishes the connection, the attacker-controlled JDBC driver/endpoint triggers deserialization of a malicious payload, leading to remote code execution on the DataEase server. Public exploit material is referenced in the GitHub security advisory (GHSA-7wcv-j6gc-qc7q).