CVE-2025-62419 DataEase vulnerable to JDBC URL injection in DB2 and MongoDB data source configuration

High 8.2 Published 17 Oct 2025 Updated 17 Oct 2025

Attackers can inject malicious JDBC strings via DB2 or MongoDB data source configuration to execute arbitrary code.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-62419?

CVE-2025-62419 is a high-severity code injection vulnerability in Dataease Dataease, published on 17 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vulnerability exists in the DB2 and MongoDB data source configuration handlers. In the DB2 data source handler, when the extraParams field is empty, the HOSTNAME, PORT, and DATABASE values are directly concatenated into the JDBC URL without filtering illegal parameters. This allows an attacker to inject a malicious JDBC string into the HOSTNAME field to bypass previously patched vulnerabilities CVE-2025-57773 and CVE-2025-58045. The vulnerability is fixed in version 2.10.14. No known workarounds exist.

Weakness: CWE-502

Which versions are affected by CVE-2025-62419?

It affects 1 product.

Products include Dataease Dataease.

How do I fix CVE-2025-62419?

No fix has been published for CVE-2025-62419 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-62419 being exploited?

There is no known exploitation of CVE-2025-62419 in the wild and no public exploit code.

All Dataease Dataease vulnerabilities

Sources

Also known as GHSA-x4x9-mjcf-99r9.