CVE-2025-62422: DataEase SQL injection vulnerability
DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerable to SQL injection. An attacker can construct a malicious tableName parameter to execute arbitrary SQL commands. This issue is fixed in version 2.10.14. No known workarounds exist.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.10.14
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62422?
CVE-2025-62422 has been classified with a high severity rating due to the potential for SQL injection.
How do I fix CVE-2025-62422?
To fix CVE-2025-62422, upgrade DataEase to version 2.10.14 or later.
What versions of DataEase are affected by CVE-2025-62422?
CVE-2025-62422 affects DataEase versions 2.10.13 and earlier.
What type of vulnerability is CVE-2025-62422?
CVE-2025-62422 is a SQL injection vulnerability that allows attackers to execute arbitrary SQL commands.
What kind of attack can be performed using CVE-2025-62422?
An attacker can exploit CVE-2025-62422 by constructing a malicious tableName parameter in requests to the vulnerable API.