CVE-2025-57772: Dataease H2 JDBC RCE Bypass
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in DataEase. If the JDBC URL meets criteria, the getJdbcUrl method is returned, which acts as the getter for the JdbcUrl parameter provided. This bypasses H2's filtering logic and returns the H2 JDBC URL, allowing the "driver":"org.h2.Driver" to specify the H2 driver for the JDBC connection. The vulnerability has been fixed in version 2.10.12.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57772?
CVE-2025-57772 is considered a critical vulnerability due to the potential for remote code execution through a JDBC URL bypass.
How do I fix CVE-2025-57772?
To fix CVE-2025-57772, upgrade DataEase to version 2.10.12 or later where this vulnerability has been addressed.
What type of vulnerability is CVE-2025-57772?
CVE-2025-57772 is a remote code execution (RCE) vulnerability specific to the JDBC configuration in DataEase.
Which versions of DataEase are affected by CVE-2025-57772?
Versions of DataEase prior to 2.10.12 are affected by CVE-2025-57772.
What impact does CVE-2025-57772 have on DataEase users?
Users of affected versions of DataEase could experience unauthorized access and execution of arbitrary code, posing significant security risks.