CVE-2025-58045: Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameter

Vulnerability summary

CVE-2025-58045 is a critical (CVSS 9.8) Server-Side Request Forgery vulnerability in dataease. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 53.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 15-09-2025
   PublishedVulnerability first disclosed.
2. 15-09-2025
   Last modifiedVulnerability information updated.

Description

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserialization remote code execution attacks only blacklisted the rmi parameter. The ldap parameter in the DB2 JDBC connection string was not filtered, allowing attackers to exploit the DB2 JDBC connection string to trigger server-side request forgery (SSRF). In higher versions of Java, ldap deserialization (autoDeserialize) is disabled by default, preventing remote code execution, but SSRF remains exploitable. Versions up to 2.10.12 are affected. The issue is fixed in version 2.10.13. Updating to 2.10.13 or later is recommended. No known workarounds are documented aside from upgrading.

• CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.