CVE-2025-49002: Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability
DataEase is an open source business intelligence and data visualization tool. Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited. The vulnerability has been fixed in v2.10.10. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49002?
The severity of CVE-2025-49002 is classified as high due to its potential for exploitation through bypassing security measures.
How do I fix CVE-2025-49002?
To fix CVE-2025-49002, upgrade your DataEase installation to version 2.10.10 or later.
What versions of DataEase are affected by CVE-2025-49002?
DataEase versions prior to 2.10.10 are affected by CVE-2025-49002.
What is exploited in CVE-2025-49002?
CVE-2025-49002 exploits a flaw in the patch for CVE-2025-32966 by leveraging case insensitivity.
Are there any workarounds for CVE-2025-49002?
There are no recommended workarounds for CVE-2025-49002; upgrading is the preferred solution.