CVE-2025-58045

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserialization remote code execution attacks only blacklisted the rmi parameter. The ldap parameter in the DB2 JDBC connection string was not filtered, allowing attackers to exploit the DB2 JDBC connection string to trigger server-side request forgery (SSRF). In higher versions of Java, ldap deserialization (autoDeserialize) is disabled by default, preventing remote code execution, but SSRF remains exploitable. Versions up to 2.10.12 are affected. The issue is fixed in version 2.10.13. Updating to 2.10.13 or later is recommended. No known workarounds are documented aside from upgrading.

• CWE-918

• https://github.com/dataease/dataease/commit/77078658715bd85af5867afbfd5f1fcc37cf03c8Patch
• https://github.com/dataease/dataease/security/advisories/GHSA-fmq3-6xhc-r845Exploit, Vendor Advisory
• https://github.com/dataease/dataease/security/advisories/GHSA-fmq3-6xhc-r845Exploit, Vendor Advisory

Published

Sep 15, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5804Improper Control of Filename for Include/Require Statement i…7.5
• CVE-2025-58040Rejected reason: Not used
• CVE-2025-58041Rejected reason: Not used
• CVE-2025-58042Rejected reason: Not used
• CVE-2025-58043Rejected reason: Not used
• CVE-2025-58044JumpServer is an open source bastion host and an operation a…6.1
• CVE-2025-58046Dataease is an open-source data visualization and analysis p…9.8
• CVE-2025-58047Volto is a React based frontend for the Plone Content Manage…7.5
• CVE-2025-58048Paymenter is a free and open-source webshop solution for hos…9.9
• CVE-2025-58049XWiki Platform is a generic wiki platform offering runtime s…7.5
• CVE-2025-5805Missing Authorization vulnerability in Ninetheme Electron el…6.5
• CVE-2025-58050The PCRE2 library is a set of C functions that implement reg…9.1