CVE-2025-24974: DataEase Mysql JDBC Connection Parameters Not Being Verified Leads to Arbitrary File Read Vulnerability
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, authenticated users can read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24974?
CVE-2025-24974 is classified as a medium severity vulnerability due to its potential impact on data security and unauthorized access.
How do I fix CVE-2025-24974?
To fix CVE-2025-24974, upgrade DataEase to version 2.10.6 or later.
Who is affected by CVE-2025-24974?
Authenticated users of DataEase versions prior to 2.10.6 are affected by CVE-2025-24974.
What is the nature of the vulnerability in CVE-2025-24974?
CVE-2025-24974 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection.
Are there any workarounds for CVE-2025-24974?
No known workarounds are available for CVE-2025-24974, making an upgrade essential.