CVE-2025-53006

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-53006

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

D

ataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference lies in that "sslfactory" and related parameters need to be triggered after establishing the connection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassName". This issue has been patched in 2.10.11.

References
Link Resource
https://github.com/dataease/dataease/security/advisories/GHSA-q726-5pr9-x7gm Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*
History

10 Jul 2025, 15:16

Type Values Removed Values Added
First Time Dataease dataease
Dataease
References () https://github.com/dataease/dataease/security/advisories/GHSA-q726-5pr9-x7gm - () https://github.com/dataease/dataease/security/advisories/GHSA-q726-5pr9-x7gm - Exploit, Vendor Advisory
CPE cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

03 Jul 2025, 15:13

Type Values Removed Values Added
Summary
  • (es) DataEase es una herramienta de código abierto para inteligencia empresarial y visualización de datos. Antes de la versión 2.10.11, tanto en PostgreSQL como en Redshift, además de parámetros como "socketfactory" y "socketfactoryarg", también existían "sslfactory" y "sslfactoryarg" con funcionalidades similares. La diferencia radica en que "sslfactory" y sus parámetros relacionados deben activarse tras establecer la conexión. Otros parámetros similares incluyen "sslhostnameverifier", "sslpasswordcallback" y "authenticationPluginClassName". Este problema se ha corregido en la versión 2.10.11.

02 Jul 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-02 15:15

Updated : 2025-07-10 15:16

NVD link : CVE-2025-53006

Mitre link : CVE-2025-53006

CVE.ORG link : CVE-2025-53006

JSON object : View

Products Affected

dataease

CWE
CWE-153

Improper Neutralization of Substitution Characters