CVE-2025-53006

Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability

State: Published
Severity: 8.9 High
Published: Jul 2, 2025
Updated: Jul 2, 2025
Reserved: Jun 24, 2025

Description

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference lies in that "sslfactory" and related parameters need to be triggered after establishing the connection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassName". This issue has been patched in 2.10.11.

Scores

CVSS	Score	Vector	Source
4.0	8.9 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P	GitHub_M

Weaknesses

CWE-153 Improper Neutralization of Substitution Characters

Affected Products

Product	Versions
dataeasedataease	< 2.10.11Affected

References

https://github.com/dataease/dataease/security/advisories/GHSA-q726-5pr9-x7gm

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.