Dataease EUVD-2025-16761

CVSS 8.8 with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates moderate-to-high real-world risk. The network-accessible attack vector (AV:N) and low complexity (AC:L) are concerning, but the requirement for authenticated privileges (PR:L) significantly reduces the threat model—this is an insider/lateral-movement risk rather than unauthenticated remote code execution. The high impact across all three security properties (confidentiality, integrity, availability) suggests potential for data exfiltration, system compromise, and denial of service. The fact that this is a bypass of CVE-2025-27103 indicates: (1) the vulnerability was known and partially patched, (2) the patch was incomplete, and (3) attackers may have refined techniques to circumvent the original fix. Without public EPSS data or KEV confirmation, the prioritization depends on: whether DataEase instances are internet-facing, user base size, and the sensitivity of underlying databases. For organizations with extensive DataEase deployments accessing sensitive data, this warrants immediate patching; for isolated internal tools, risk is lower but still significant due to insider threat potential.

An attacker with valid DataEase credentials (obtained through credential compromise, insider threat, or account enumeration) logs into the DataEase platform. The attacker crafts a malicious JDBC connection configuration or injects a payload into a report/query that triggers the background JDBC service. The payload exploits the insecure deserialization flaw in JDBC parameter handling to read sensitive files from the DataEase server (e.g., /etc/passwd, database configuration files, API keys, or private data files). Alternatively, the attacker modifies JDBC connection parameters to point to an internal database and executes arbitrary SQL queries to exfiltrate sensitive business data or modify records. The low-complexity attack vector and lack of UI interaction requirement (UI:N) mean this could be automated through a simple script or integrated into a post-compromise tool suite. For example: an attacker with a compromised business analyst account could silently read DataEase configuration files containing database credentials, then pivot to directly compromise the underlying analytics database. A proof-of-concept would likely demonstrate file read or SQL injection through the JDBC interface; however, the existence of v2.10.10 as a patched version suggests the vulnerability is real and reproducible.