CVE-2025-64164: DataEase is vulnerable to Oracle JNDI Injection
Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishing JDBC connections to Oracle, resulting in a risk of JNDI injection (Java Naming and Directory Interface injection). This issue is fixed in version 2.10.15.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64164?
CVE-2025-64164 has a high severity due to its potential for JNDI injection in DataEase versions up to 2.10.14.
How do I fix CVE-2025-64164?
To fix CVE-2025-64164, upgrade DataEase to version 2.10.15 or later, where the vulnerability is addressed.
What versions are affected by CVE-2025-64164?
CVE-2025-64164 affects DataEase versions 2.10.14 and below.
What is the main vulnerability described in CVE-2025-64164?
The main vulnerability in CVE-2025-64164 is improper filtering during JDBC connections to Oracle, leading to a risk of JNDI injection.
Is there a patch available for CVE-2025-64164?
Yes, a patch is available in DataEase version 2.10.15 and later to resolve the issue described in CVE-2025-64164.