Code Injection via SpyAttribute log=(file) in Progress DataDirect Connect JDBC
CVE-2025-10703 Published on November 19, 2025

Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JDBC drivers, DataDirect Hybrid Data Pipeline JDBC driver and the DataDirect OpenAccess JDBC driver log=(file) construct allows the user to specify an arbitrary file for the JDBC driver to write its log information to. If an application allows an end user to specify a value for the SpyAttributes connection option then an attacker could cause java script to be written to a log file. If the log file was in the correct location with the correct extension, an application server could see that log file as a resource to be served. The attacker could fetch the resource from the server causing the java script to be executed. This issue affects: DataDirect Connect for JDBC for Amazon Redshift: through 6.0.0.001392, fixed in 6.0.0.001541 DataDirect Connect for JDBC for Apache Cassandra: through 6.0.0.000805, fixed in 6.0.0.000833 DataDirect Connect for JDBC for Hive: through 6.0.1.001499, fixed in 6.0.1.001628 DataDirect Connect for JDBC for Apache Impala: through 6.0.0.001155, fixed in 6.0.0.001279 DataDirect Connect for JDBC for Apache SparkSQL: through 6.0.1.001222, fixed in 6.0.1.001344 DataDirect Connect for JDBC Autonomous REST Connector: through 6.0.1.006961, fixed in 6.0.1.007063 DataDirect Connect for JDBC for DB2: through 6.0.0.000717, fixed in 6.0.0.000964 DataDirect Connect for JDBC for Google Analytics 4: through 6.0.0.000454, fixed in 6.0.0.000525 DataDirect Connect for JDBC for Google BigQuery: through 6.0.0.002279, fixed in 6.0.0.002410 DataDirect Connect for JDBC for Greenplum: through 6.0.0.001712, fixed in 6.0.0.001727 DataDirect Connect for JDBC for Informix: through 6.0.0.000690, fixed in 6.0.0.0851 DataDirect Connect for JDBC for Microsoft Dynamics 365: through 6.0.0.003161, fixed in 6.0.0.3198 DataDirect Connect for JDBC for Microsoft SQLServer: through 6.0.0.001936, fixed in 6.0.0.001957 DataDirect Connect for JDBC for Microsoft Sharepoint: through 6.0.0.001559, fixed in 6.0.0.001587 DataDirect Connect for JDBC for MongoDB: through 6.1.0.001654, fixed in 6.1.0.001669 DataDirect Connect for JDBC for MySQL: through 5.1.4.000330, fixed in 5.1.4.000364 DataDirect Connect for JDBC for Oracle Database: through 6.0.0.001747, fixed in 6.0.0.001776 DataDirect Connect for JDBC for Oracle Eloqua: through 6.0.0.001438, fixed in 6.0.0.001458 DataDirect Connect for JDBC for Oracle Sales Cloud: through 6.0.0.001225, fixed in 6.0.0.001316 DataDirect Connect for JDBC for Oracle Service Cloud: through 5.1.4.000298, fixed in 5.1.4.000309 DataDirect Connect for JDBC for PostgreSQL: through 6.0.0.001843, fixed in 6.0.0.001856 DataDirect Connect for JDBC for Progress OpenEdge: through 5.1.4.000187, fixed in 5.1.4.000189 DataDirect Connect for JDBC for Salesforce: through 6.0.0.003020, fixed in 6.0.0.003125 DataDirect Connect for JDBC for SAP HANA: through 6.0.0.000879, product retired DataDirect Connect for JDBC for SAP S/4 HANA: through 6.0.1.001818, fixed in 6.0.1.001858 DataDirect Connect for JDBC for Sybase ASE: through 5.1.4.000161, fixed in 5.1.4.000162 DataDirect Connect for JDBC for Snowflake: through 6.0.1.001821, fixed in 6.0.1.001856 DataDirect Hybrid Data Pipeline Server: through 4.6.2.3309, fixed in 4.6.2.3430 DataDirect Hybrid Data Pipeline JDBC Driver: through 4.6.2.0607, fixed in 4.6.2.1023 DataDirect Hybrid Data Pipeline On Premises Connector: through 4.6.2.1223, fixed in 4.6.2.1339 DataDirect Hybrid Data Pipeline Docker: through 4.6.2.3316, fixed in 4.6.2.3430 DataDirect OpenAccess JDBC Driver: through 8.1.0.0177, fixed in 8.1.0.0183 DataDirect OpenAccess JDBC Driver: through 9.0.0.0019, fixed in 9.0.0.0022

NVD

Weakness Type

What is a Code Injection Vulnerability?

The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVE-2025-10703 has been classified to as a Code Injection vulnerability or weakness.

Products Associated with CVE-2025-10703

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-10703 are published in Progress Openedge:

Progress Openedge

Affected Versions

Progress DataDirect Connect for JDBC for Amazon Redshift:

Before and including 6.0.0.001392 is affected.
Version 6.0.0.001541 is unaffected.

Progress DataDirect Connect for JDBC for Apache Cassandra:

Before and including 6.0.0.000805 is affected.
Version 6.0.0.000833 is unaffected.

Progress DataDirect Connect for JDBC for Hive:

Before and including 6.0.1.001499 is affected.
Version 6.0.1.001628 is unaffected.

Progress DataDirect Connect for JDBC for Apache Impala:

Before and including 6.0.0.001155 is affected.
Version 6.0.0.1279 is unaffected.

Progress DataDirect Connect for JDBC for Apache SparkSQL:

Before and including 6.0.1.001222 is affected.
Version 6.0.1.001344 is unaffected.

Progress DataDirect Connect for JDBC Autonomous REST Connector:

Before and including 6.0.1.006961 is affected.
Version 6.0.1.007063 is unaffected.

Progress DataDirect Connect for JDBC for DB2:

Before and including 6.0.0.000717 is affected.
Version 6.0.0.000964 is unaffected.

Progress DataDirect Connect for JDBC for Google Analytics 4:

Before and including 6.0.0.000454 is affected.
Version 6.0.0.000525 is unaffected.

Progress DataDirect Connect for JDBC for Google BigQuery:

Before and including 6.0.0.002279 is affected.
Version 6.0.0.002410 is unaffected.

Progress DataDirect Connect for JDBC for Greenplum:

Before and including 6.0.0.001712 is affected.
Version 6.0.0.001727 is unaffected.

Progress DataDirect Connect for JDBC for Informix:

Before and including 6.0.0.000690 is affected.
Version 6.0.0.000851 is unaffected.

Progress DataDirect Connect for JDBC for Microsoft Dynamics 365:

Before and including 6.0.0.003161 is affected.
Version 6.0.0.003198 is unaffected.

Progress DataDirect Connect for JDBC for Microsoft SQLServer:

Before and including 6.0.0.001936 is affected.
Version 6.0.0.001957 is unaffected.

Progress DataDirect Connect for JDBC for Microsoft Sharepoint:

Before and including 6.0.0.001559 is affected.
Version 6.0.0.001587 is unaffected.

Progress DataDirect Connect for JDBC for MongoDB:

Before and including 6.1.0.001654 is affected.
Version 6.1.0.001669 is unaffected.

Progress DataDirect Connect for JDBC for MySQL:

Before and including 5.1.4.000330 is affected.
Version 5.1.4.000364 is unaffected.

Progress DataDirect Connect for JDBC for Oracle Database:

Before and including 6.0.0.001747 is affected.
Version 6.0.0.001776 is unaffected.

Progress DataDirect Connect for JDBC for Oracle Eloqua:

Before and including 6.0.0.001438 is affected.
Version 6.0.0.001458 is unaffected.

Progress DataDirect Connect for JDBC for Oracle Sales Cloud:

Before and including 6.0.0.001225 is affected.
Version 6.0.0.001316 is unaffected.

Progress DataDirect Connect for JDBC for Oracle Service Cloud:

Before and including 5.1.4.000298 is affected.
Version 5.1.4.000309 is unaffected.

Progress DataDirect Connect for JDBC for PostgreSQL:

Before and including 6.0.0.001843 is affected.
Version 6.0.0.001856 is unaffected.

DataDirect Connect for JDBC for Progress OpenEdge:

Before and including 5.1.4.000187 is affected.
Version 5.1.4.000189 is unaffected.

Progress DataDirect Connect for JDBC for Salesforce:

Before and including 6.0.0.003020 is affected.
Version 6.0.0.003125 is unaffected.

Progress DataDirect Connect for JDBC for SAP HANA:

Before and including 6.0.0.000879 is affected.

Progress DataDirect Connect for JDBC for SAP S/4 HANA:

Before and including 6.0.0.001818 is affected.
Version 6.0.1.001858 is unaffected.

Progress DataDirect Connect for JDBC for Sybase ASE:

Before and including 5.1.4.000161 is affected.
Version 5.1.4.000162 is unaffected.

Progress DataDirect Connect for JDBC for Snowflake:

Before and including 6.0.1.001821 is affected.
Version 6.0.1.001856 is unaffected.

Progress DataDirect Hybrid Data Pipeline Server:

Before and including 4.6.2.3309 is affected.
Version 4.6.2.3430 is unaffected.

Progress DataDirect Hybrid Data Pipeline JDBC Driver:

Before and including 4.6.2.0607 is affected.
Version 4.6.2.1023 is unaffected.

Progress DataDirect Hybrid Data Pipeline On Premises Connector:

Before and including 4.6.2.1223 is affected.
Version 4.6.2.1339 is unaffected.

Progress DataDirect Hybrid Data Pipeline Docker:

Before and including 4.6.2.3316 is affected.
Version 4.6.2.3430 is unaffected.

Progress DataDirect OpenAccess JDBC Driver:

Before and including 8.1.0.0177 is affected.
Version 8.1.0.0183 is unaffected.

Progress DataDirect OpenAccess JDBC Driver:

Before and including 9.0.0.0019 is affected.
Version 9.0.0.0022 is unaffected.

Exploit Probability

EPSS

0.29%

Percentile

51.69%