CVE-2025-48999

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-48999

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48999.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2025-48999

Aliases

GHSA-6pq2-6q8x-mp2r

Published

2025-06-03T20:31:13.950Z

Modified

2026-06-15T20:04:23.841275Z

Severity

6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability

Details

DataEase is an open source business intelligence and data visualization tool. A bypass of CVE-2025-46566's patch exists in versions prior to 2.10.10. In a malicious payload, getUrlType() retrieves hostName. Since the judgment statement returns false, it will not enter the if statement and will not be filtered. The payload can be directly concatenated at the replace location to construct a malicious JDBC statement. Version 2.10.10 contains a patch for the issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48999.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284",
        "CWE-923"
    ]
}

References

Affected packages

Git / github.com/dataease/dataease

Affected ranges

Type

GIT

Repo

https://github.com/dataease/dataease

Events

Introduced

Fixed

3b8f018abb6d3846a7ebb694bbe5cbf35a932104

Fixed

03b18db8a0fb7e9dc2c44f6d26d8c6221b7748c4

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.10.10"
        }
    ],
    "cpe": "cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*

v1.0.0

v2.*

v2.10.0

v2.10.1

v2.10.2

v2.10.3

v2.10.4

v2.10.5

v2.10.6

v2.10.7

v2.10.8

v2.10.9

v2.2.0

v2.3.0

v2.6.0

Database specific

vanir_signatures_modified

"2026-06-15T20:04:23Z"

vanir_signatures

[
    {
        "digest": {
            "function_hash": "108583883577562457624925327870902475567",
            "length": 368.0
        },
        "signature_version": "v1",
        "id": "CVE-2025-48999-6f3f63f0",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/datasource/type/Redshift.java",
            "function": "getJdbc"
        },
        "source": "https://github.com/dataease/dataease/commit/03b18db8a0fb7e9dc2c44f6d26d8c6221b7748c4"
    },
    {
        "digest": {
            "line_hashes": [
                "27627074303964318882417323486351141630",
                "97142947938543604819636395956544387028",
                "40377677079330361915937831577686115372",
                "121216136401205500103447404652187148247",
                "21984936131719803008643477252148025788",
                "197609987962733016545062199879861464352",
                "317143147435927274322284371066829771593",
                "176467234526973742004517108321347979027",
                "123081837941841445117286324272641639305",
                "230413827549299870676532268452966731911",
                "155492726525485500818202825548485514582",
                "15449972454824085861570954098415939735"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "id": "CVE-2025-48999-dc201d4d",
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/datasource/type/Redshift.java"
        },
        "source": "https://github.com/dataease/dataease/commit/03b18db8a0fb7e9dc2c44f6d26d8c6221b7748c4"
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-48999.json"