TI-2022-18688 Aliases CVE-2022-39312 GHSA-q4qq-jhjv-7rh2

Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability

HIGH 82CWE-20Published 2022-10-25 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source in the data source function can customize the JDBC connection parameters and the Mysql server target to be connected. In `backend/src/main/java/io/dataease/provider/datasource/JdbcProvider.java`, the `MysqlConfiguration` class does not filter any parameters. If an attacker adds some parameters to a JDBC url and connects to a malicious mysql server, the attacker can trigger the mysql jdbc deserialization vulnerability. Through the deserialization vulnerability, the attacker can execute system commands and obtain server privileges. Version 1.15.2 contains a patch for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01926 80th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed dataease (dataease): 1.15.2io.dataease:dataease-plugin-common (Maven): 1.15.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
dataease	dataease	before 1.15.2	1.15.2	Patch available	CNA
—	io.dataease:dataease-plugin-common (Maven)	before 1.15.2	1.15.2	Patch available	GHSA-q4qq-jhjv-7rh2

dataease Vendordataease Affected before 1.15.2 Fixed in 1.15.2 Patch available CNA
io.dataease:dataease-plugin-common (Maven) Vendor— Affected before 1.15.2 Fixed in 1.15.2 Patch available GHSA-q4qq-jhjv-7rh2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dataease:dataease::::::::	before 1.15.2	Vulnerable	dataease

cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* Versions before 1.15.2 Vulnerable ·dataease

Remediation

Fix · CNA dataease (dataease) Fixed in 1.15.2
Fix · GHSA-q4qq-jhjv-7rh2 io.dataease:dataease-plugin-common (Maven) Fixed in 1.15.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-39312
2026-10-03 Alias added: GHSA-q4qq-jhjv-7rh2

References

Exploit 1

https://github.com/dataease/dataease/security/advisories/GHSA-q4qq-jhjv-7rh2

Patch 2

Advisory 2

Other 1

https://github.com/dataease/dataease

TI-2024-38037 An issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components. CVSS 3.1CRITICAL 9.8
TI-2023-12981 SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed CVSS 3.1CRITICAL 9.8
TI-2026-24677 Dataease: Redshift JDBC RCE Bypass CVSS 4.0CRITICAL 9.3
TI-2026-24674 DataEase SQL Injection Vulnerability CVSS 4.0CRITICAL 9.3
TI-2024-37398 DataEase has an unauthorized vulnerability CVSS 4.0CRITICAL 9.3
TI-2025-39841 DataEase DB2 JNDI Vulnerability CVSS 4.0HIGH 8.9

See all 71 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences