JNDI Injection Vulnerability in Dataease Open Source Data Visualization Tool
CVE-2025-64428

8.9HIGH

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
20 November 2025

What is CVE-2025-64428?

Dataease, an open source data visualization analysis tool, is susceptible to JNDI injection in versions prior to 2.10.17. Although a blacklist was introduced in version 2.10.14, attackers can still exploit vulnerabilities through specific schemes such as iiop, corbaname, and iiopname. The vulnerability was addressed in the subsequent release of version 2.10.17, which mitigates these risks. It is essential for users to update to this version to safeguard against potential threats posed by this vulnerability.

Affected Version(s)

dataease < 2.10.17

References

https://github.com/dataease/dataease/security/advisories/...
x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/b7e585c1cc3fc...
x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.17
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-64428 : JNDI Injection Vulnerability in Dataease Open Source Data Visualization Tool