CVE-2025-27138: DataEase has an improper authentication vulnerability

Q: What is the severity of CVE-2025-27138?

CVE-2025-27138 has a moderate severity level due to the risk of unauthorized access.

Q: How do I fix CVE-2025-27138?

To fix CVE-2025-27138, upgrade to DataEase version 2.10.6 or later.

Q: What impact does CVE-2025-27138 have on my system?

CVE-2025-27138 can lead to unauthorized access to sensitive data if not mitigated.

Q: Is my version vulnerable to CVE-2025-27138?

If you are using a version prior to DataEase 2.10.6, your system is vulnerable to CVE-2025-27138.

Q: What components are affected by CVE-2025-27138?

CVE-2025-27138 affects the io.dataease.auth.filter.TokenFilter class in DataEase.

Published Mar 13, 2025

Updated

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access. The vulnerability has been fixed in v2.10.6. No known workarounds are available.

Affected Software

2 affected components

Dataease DataEase<2.10.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DataEase to a version that resolves this vulnerability.
Fixed in 2.10.6

Event History

Mar 13, 2025

CVE Published

via MITRE·04:49 PM

Data Sourced

via MITRE·04:49 PM

DescriptionWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

May 21, 58462

Event

via NVD·02:52 PM

Frequently Asked Questions

What is the severity of CVE-2025-27138?

CVE-2025-27138 has a moderate severity level due to the risk of unauthorized access.

How do I fix CVE-2025-27138?

To fix CVE-2025-27138, upgrade to DataEase version 2.10.6 or later.

What impact does CVE-2025-27138 have on my system?

CVE-2025-27138 can lead to unauthorized access to sensitive data if not mitigated.

Is my version vulnerable to CVE-2025-27138?