Remote Code Execution Vulnerability in DataEase BI Tool
CVE-2025-46566

6.8MEDIUM

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
1 May 2025

What is CVE-2025-46566?

DataEase, an open-source business intelligence tool that serves as an alternative to Tableau, has a vulnerability that allows authenticated users to execute remote code via the backend JDBC link. This critical issue, affecting versions prior to 2.10.9, has been addressed in the latest update, enhancing the security posture of the application.

Affected Version(s)

dataease < 2.10.9

References

https://github.com/dataease/dataease/security/advisories/...
x_refsource_CONFIRM

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.