CVE-2025-64428 HIGH

CVE-2025-64428: DataEase DB2 JNDI Vulnerability

Vendor Dataease
Product dataease
Weakness CWE-74
Published November 20, 2025
Last update November 21, 2025
View on NVD All CVEs

CVSS base score

8.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was added in the patch for version 2.10.14. However, JNDI injection remains possible via the iiop, corbaname, and iiopname schemes. The vulnerability has been fixed in version 2.10.17.

Key dates

02Disclosure timeline

November 20, 2025 CVE published
November 21, 2025 Record updated