JDBC Driver Bypass Vulnerability in DataEase by DataEase Technologies
CVE-2025-62420

8.2HIGH

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
17 October 2025

What is CVE-2025-62420?

The JDBC driver bypass vulnerability in DataEase's H2 database connection handler allows an authenticated attacker to exploit the getJdbc function in H2.java. By providing a jdbcUrl that starts with jdbc:h2 alongside a different jdbc field, attackers can trigger arbitrary JDBC connections using malicious drivers. This could potentially lead to remote code execution, compromising the integrity and security of data analytics processes. The issue affects all DataEase versions up to 2.10.13 and is mitigated in version 2.10.14. Currently, there are no known workarounds for this vulnerability.

Affected Version(s)

dataease < 2.10.14

References

https://github.com/dataease/dataease/security/advisories/...
x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/bb320e42bf2cf...
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.