Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-64164

Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishing JDBC connections to Oracle, resulting in a risk of JNDI injection (Java Naming and Directory Interface injection). This issue is fixed in version 2.10.15.

Published

2025-11-06T01:15:38.333

Last Modified

2025-11-07T18:06:49.890

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses

Type: Secondary
CWE-502

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	dataease	dataease	< 2.10.15	Yes

References

https://github.com/dataease/dataease/commit/7b68eb3dfccbbd12ec977e6320dbd3e32a7bbfe6 Patch ([email protected])
https://github.com/dataease/dataease/releases/tag/v2.10.15 Release Notes ([email protected])
https://github.com/dataease/dataease/security/advisories/GHSA-q754-4pc2-wjqw Exploit, Patch, Third Party Advisory ([email protected])