Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-64163

DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. However, omission of protection for the dns:// protocol results in an SSRF vulnerability. This issue is fixed in version 2.10.15.

Published

2025-11-06T00:15:38.150

Last Modified

2025-11-07T18:06:36.263

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses

Type: Secondary
CWE-918

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	dataease	dataease	< 2.10.15	Yes

References

https://github.com/dataease/dataease/commit/869b7fb8b10069ac6c326554bfa8f060a539ba85 Patch ([email protected])
https://github.com/dataease/dataease/releases/tag/v2.10.15 Release Notes ([email protected])
https://github.com/dataease/dataease/security/advisories/GHSA-8397-v66p-539m Exploit, Patch, Third Party Advisory ([email protected])