Dataease vulnerabilities

CVE-2024-30269 [MEDIUM] CWE-200 CVE-2024-30269: DataEase, an open source data visualization and analysis tool, has a database configuration informat DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the `/de2api/engine/getEngine;.js` path via a browser reveals that the platform's database configuration is returned. The vulnerability has been fixed in v2.5.0. No known workarounds are avai

CVE-2025-49002 [CRITICAL] CVE-2025-49002: DataEase is an open source business intelligence and data visualization tool. Versions prior to vers DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited. The vulnerability has been fixed in v2.10.10. No known workarounds are available.

CVE-2025-49001 [CRITICAL] CWE-287 CVE-2025-49001: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10. DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No known workarounds are available.

CVE-2025-32966 [CRITICAL] CWE-290 CVE-2025-32966: DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated us DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend JDBC link. This issue has been patched in version 2.10.8.

CVE-2024-47073 [CRITICAL] CWE-347 CVE-2024-47073: DataEase is an open source data visualization analysis tool that helps users quickly analyze data an DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The vulnerability has been fixed in v2.10.2 and all users are advi

CVE-2024-56511 [CRITICAL] CWE-289 CVE-2024-56511: DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. In the io.dataease.auth.filter.TokenFilter class, ”request.getRequestURI“ is used to obtain the request URL, and it is

CVE-2025-58046 [CRITICAL] CWE-74 CVE-2025-58046: Dataease is an open-source data visualization and analysis platform. In versions up to and including Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote code execution due to insufficient filtering in the getJdbc method of the io.dataease.datasource.type.Impala class. Attackers can construct malicious JDBC connection strings that exploit JNDI i

CVE-2025-57772 [CRITICAL] CWE-94 CVE-2025-57772: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10. DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's filtering logic and returns the H2 JDBC URL, allowing th

CVE-2025-57773 [CRITICAL] CWE-94 CVE-2025-57773: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10. DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability requires commons-collections 4.x and aspectjweaver-1.9.

CVE-2025-58748 [CRITICAL] CWE-502 CVE-2025-58748: Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.1 Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12 the H2 data source implementation (H2.java) does not verify that a provided JDBC URL starts with jdbc:h2. This lack of validation allows a crafted JDBC configuration that substitutes the Amazon Redshift driver and leverages the socketFactory an

CVE-2025-58045 [CRITICAL] CWE-918 CVE-2025-58045: Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.1 Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserialization remote code execution attacks only blacklisted the rmi parameter. The ldap parameter in the DB2 JDBC connection string was not filtered, allowing attackers to exploit the DB2 JDBC conne

CVE-2025-62420 [HIGH] CWE-502 CVE-2025-62420: DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDB DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC driver bypass vulnerability exists in the H2 database connection handler. The getJdbc function in H2.java checks if the jdbcUrl starts with jdbc:h2 but returns a separate jdbc field as the actual connection URL. An attacker can provide a jdbcUrl that

CVE-2026-40901 [HIGH] CWE-502 CVE-2026-40901: DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below shi DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializes job data BLOBs from the qrtz_job_details table using

CVE-2025-49003 [CRITICAL] CWE-153 CVE-2025-49003: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10. DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java in which the character "ı" becomes "I" when converted to uppercase, and the character "ſ" becomes "S" when converted to uppercase. A threat actor who uses a carefully crafted message that ex

CVE-2025-48999 [HIGH] CVE-2025-48999: DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-4 DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a malicious payload, `getUrlType()` retrieves `hostName`. Since the judgment statement returns false, it will not enter the if statement and will not be filtered. The payload can be directly concatenated at t

CVE-2025-27138 [CRITICAL] CWE-287 CVE-2025-27138: DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10. DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access. The vulnerability has been fixed in v2.10.6. No known workarounds are available.

CVE-2026-33122 [CRITICAL] CWE-89 CVE-2026-33122: DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below con DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource update process. When a new table definition is added during a datasource update via /de2api/datasource/update, the deTableName field from the user-submitted configuration is passed to Datasourc

CVE-2026-32140 [HIGH] CWE-22 CVE-2026-32140: Dataease is an open source data visualization analysis tool. Prior to 2.10.20, By controlling the In Dataease is an open source data visualization analysis tool. Prior to 2.10.20, By controlling the IniFile parameter, an attacker can force the JDBC driver to load an attacker-controlled configuration file. This configuration file can inject dangerous JDBC properties, leading to remote code execution. The Redshift JDBC driver execution flow reaches a me

CVE-2026-40900 [HIGH] CWE-89 CVE-2026-40900: DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below con DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /de2api/datasetData/previewSql endpoint. The user-supplied SQL is wrapped in a subquery without validation that the input is a single SELECT statement. Combined with the JDBC blocklist bypass that allows enabling

CVE-2024-46997 [CRITICAL] CWE-74 CVE-2024-46997: DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker ca DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1.