EUVD-2025-16761Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionGitHub Advisory
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27103 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.10. No known workarounds are available.
AnalysisAI
Critical authentication bypass vulnerability in DataEase (open-source BI/data visualization tool) affecting versions prior to 2.10.6, which allows authenticated users to read and deserialize arbitrary files through JDBC background connections. This represents a bypass of the patch for CVE-2025-27103, escalating the risk from the original vulnerability. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability, though exploitation requires valid credentials (PR:L). No public exploit code availability or active KEV listing has been confirmed, but the patch availability (v2.10.10) indicates vendor acknowledgment of active exploitation risk.
Technical ContextAI
The vulnerability exploits insecure deserialization in DataEase's JDBC connection handling layer. CWE-89 (SQL Injection) classification suggests the root cause involves improper sanitization of JDBC connection parameters or SQL query construction, allowing attackers to inject arbitrary commands through the database connection interface. The background JDBC connection mechanism appears to execute queries with insufficient validation, permitting attackers to read arbitrary files from the underlying system. This is a second-order bypass of CVE-2025-27103, indicating the initial patch failed to comprehensively address the deserialization attack surface. The vulnerability chain likely involves: (1) authenticated session establishment, (2) manipulation of JDBC connection parameters or query payloads, (3) unsafe deserialization of server responses, and (4) file system access through the database driver's capabilities.
RemediationAI
Immediate actions: (1) Upgrade DataEase to version 2.10.10 or later—this is the confirmed patched version. (2) If immediate patching is not possible, restrict JDBC connector functionality or disable background job processing until patched. (3) Implement network segmentation to limit authenticated user access to DataEase instances. (4) Review JDBC connection configurations and ensure database credentials have minimal required permissions (principle of least privilege). (5) Monitor DataEase logs for suspicious JDBC queries or file-read attempts. (6) Audit recent user activity logs to detect if the vulnerability was exploited before patching. No workarounds are available per the CVE description, so patching is mandatory. Users should also review the patch for CVE-2025-27103 to understand what was missed in the initial fix and verify the v2.10.10 patch addresses the root cause comprehensively.
Share
External POC / Exploit Code
Leaving vuln.today