CVE-2025-49003: Dataease H2 JDBC Connection Remote Code Execution
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor may take advantage of a feature in Java in which the character "ı" becomes "I" when converted to uppercase, and the character "ſ" becomes "S" when converted to uppercase. A threat actor who uses a carefully crafted message that exploits this character conversion can cause remote code execution. The vulnerability has been fixed in v2.10.11. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49003?
CVE-2025-49003 has a moderate severity rating due to potential character-related exploits in Java affecting DataEase versions prior to 2.10.11.
How do I fix CVE-2025-49003?
To fix CVE-2025-49003, upgrade DataEase to version 2.10.11 or later where the vulnerability has been resolved.
What is the nature of the vulnerability in CVE-2025-49003?
CVE-2025-49003 involves a Java feature that allows a threat actor to exploit character case conversions, leading to potential inaccuracies in data handling.
When was CVE-2025-49003 reported?
CVE-2025-49003 is a recent vulnerability identified in DataEase prior to version 2.10.11.
Who is affected by CVE-2025-49003?
Any user or organization using DataEase versions before 2.10.11 is affected by CVE-2025-49003 and should take immediate action to upgrade.