Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-57773

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filtered, a JNDI injection attack can be directly launched. JNDI triggers an AspectJWeaver deserialization attack, writing to various files. This vulnerability requires commons-collections 4.x and aspectjweaver-1.9.22.jar. The vulnerability has been fixed in version 2.10.12.

Published

2025-08-25T17:15:30.513

Last Modified

2025-09-03T13:43:01.133

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-94
    CWE-502
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application dataease dataease < 2.10.12 Yes
References