References https://ryze-t.com/2024/05/09/Dataease%E6%BC%8F%E6%B4%9E/ https://blog.fit2cloud.com/?p=361fddb3-f798-4bb3-88b3-94c312cc9c7e https://blog.fit2cloud.com/?p=2134892d-6fb7-4d3d-a4dd-02af05630034 https://blog.csdn.net/weixin_45519417/article/details/151222774 https://www.cnvd.org.cn/flaw/show/CNVD-2024-39251 https://cn-sec.com/archives/4389044.html https://blog.fit2cloud.com/?p=174fbd80-0570-4965-9c9a-4f69bc379caa https://github.com/dataease/dataease/security/advisories/GHSA-x97w-69ff-r55q https://ryze-t.com/2024/05/09/Dataease%E6%BC%8F%E6%B4%9E/ https://www.cnblogs.com/fuchangjiang/p/17683955.html
Related VulnerabilitiesPoCCVE-2024-56511: DataEase < 2.10.4 - Authentication Bypass via Whitelist Path TraversalPoCCVE-2025-49001: DataEase < 2.10.10 - JWT Authentication BypassPoCCVE-2025-32966: DataEase 2.10.4-2.10.7 - Remote Code ExecutionPoCCVE-2025-49002: DataEase - Remote Code Execution飞致云 Dataease 未授权 设计缺陷漏洞DataEase /de2api/datasource/validate 命令执行漏洞(CVE-2025-62420)飞致云 Dataease 需授权 服务器端请求伪造(SSRF)漏洞飞致云 DataEase 需授权 代码注入漏洞飞致云 Dataease 需授权 SQL注入漏洞飞致云 Dataease 未授权 跨站点脚本攻击(XSS)飞致云 Dataease 需授权 JDBC注入漏洞