JNDI Injection Vulnerability in DataEase Business Intelligence Tool
CVE-2025-57773

8.2HIGH

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
25 August 2025

What is CVE-2025-57773?

An identified vulnerability in DataEase allows attackers to exploit unfiltered DB2 parameters to execute JNDI injection attacks. This vulnerability can lead to the triggering of an AspectJWeaver deserialization attack, enabling unauthorized writing to various files within the system. Users are encouraged to upgrade to version 2.10.12 or higher to mitigate this risk. The successful exploitation of this vulnerability requires specific libraries, namely commons-collections 4.x and aspectjweaver-1.9.22.jar, making it crucial to address this security concern promptly.

Affected Version(s)

dataease < 2.10.12

References

https://github.com/dataease/dataease/security/advisories/...
x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/8d04e92d44e1b...
x_refsource_MISC

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.