References https://blog.fit2cloud.com/?p=f77897a6-0c63-4aea-8ec1-c447cf2e7173 https://github.com/dataease/dataease/security/advisories/GHSA-r39x-fcc6-47g4 https://ryze-t.com/2024/05/09/Dataease%E6%BC%8F%E6%B4%9E/ https://www.cnblogs.com/fuchangjiang/p/17683955.html https://blog.fit2cloud.com/?p=0890b10d-3b5e-47ab-a7d8-0008c929f1dd https://github.com/dataease/dataease/issues/510 https://avd.aliyun.com/detail?id=AVD-2023-28437 https://blog.fit2cloud.com/?p=6b11641c-a1a1-457b-8aa9-9d0dcaa8dc59 https://zhuanlan.zhihu.com/p/2016190957574448828 https://github.com/dataease/dataease/security/advisories/GHSA-vgm2-269h-8624
Related VulnerabilitiesPoCCVE-2024-56511: DataEase < 2.10.4 - Authentication Bypass via Whitelist Path TraversalPoCCVE-2025-49001: DataEase < 2.10.10 - JWT Authentication BypassPoCCVE-2025-32966: DataEase 2.10.4-2.10.7 - Remote Code ExecutionPoCCVE-2025-49002: DataEase - Remote Code Execution飞致云 Dataease 未授权 设计缺陷漏洞DataEase /de2api/datasource/validate 命令执行漏洞(CVE-2025-62420)飞致云 Dataease 需授权 代码注入漏洞飞致云 Dataease 需授权 服务器端请求伪造(SSRF)漏洞飞致云 DataEase 需授权 代码注入漏洞飞致云 Dataease 未授权 跨站点脚本攻击(XSS)