DataEase Open Source Business Intelligence Tool Vulnerabilities
CVE-2025-53006

8.9HIGH

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
2 July 2025

What is CVE-2025-53006?

DataEase, an open-source business intelligence and data visualization tool, had a vulnerability affecting versions prior to 2.10.11 that allowed misuse of the 'sslfactory' and related parameters. Once a connection was established, these parameters could alter SSL-related configurations, potentially leading to data exposure. The issue also involved similar parameters such as 'sslhostnameverifier', 'sslpasswordcallback', and 'authenticationPluginClassName'. This vulnerability underscores the importance of ensuring secure configurations, particularly for data handling in PostgreSQL and Redshift environments. Users are advised to update to version 2.10.11 or later to mitigate these risks.

Affected Version(s)

dataease < 2.10.11

References

https://github.com/dataease/dataease/security/advisories/...
x_refsource_CONFIRM

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-53006 : DataEase Open Source Business Intelligence Tool Vulnerabilities