CVE-2025-53006: Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference lies in that "sslfactory" and related parameters need to be triggered after establishing the connection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassName". This issue has been patched in 2.10.11.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53006?
The severity of CVE-2025-53006 is currently classified as moderate, as it may allow unauthorized access to various system resources.
How do I fix CVE-2025-53006?
To fix CVE-2025-53006, upgrade your DataEase installation to version 2.10.11 or later.
What are the affected versions of DataEase for CVE-2025-53006?
CVE-2025-53006 affects all versions of DataEase prior to 2.10.11.
What systems are impacted by CVE-2025-53006?
CVE-2025-53006 impacts systems using both PostgreSQL and Redshift with vulnerable versions of DataEase.
Are there any workarounds for CVE-2025-53006?
There are no known workarounds for CVE-2025-53006; upgrading to the fixed version is recommended.