CVE-2025-48999: Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability
DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a malicious payload, getUrlType() retrieves hostName. Since the judgment statement returns false, it will not enter the if statement and will not be filtered. The payload can be directly concatenated at the replace location to construct a malicious JDBC statement. Version 2.10.10 contains a patch for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48999?
CVE-2025-48999 is considered a high severity vulnerability due to its ability to bypass previous security fixes.
How do I fix CVE-2025-48999?
To remediate CVE-2025-48999, update DataEase to version 2.10.10 or later.
What vulnerability does CVE-2025-48999 bypass?
CVE-2025-48999 bypasses the patch for CVE-2025-46566.
What versions of DataEase are affected by CVE-2025-48999?
Versions of DataEase before 2.10.10 are affected by CVE-2025-48999.
What kind of attack does CVE-2025-48999 enable?
CVE-2025-48999 enables potential exploitation through a malicious payload that exploits the `getUrlType()` function.