In Apache Linkis =1.4.0, due to the lack of effective filtering
of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis = 1.4.0 will be affected.
We recommend users upgrade the version of Linkis to version 1.5.0.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2024/07/13/4 | |
| https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729 | Mailing List Vendor Advisory |
| https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729 | Mailing List Vendor Advisory |
Configurations
History
14 Mar 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | ||
| References |
|
16 Jul 2024, 18:06
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache
Apache linkis |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729 - Mailing List, Vendor Advisory | |
| CPE | cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:* |
15 Jul 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-15 08:15
Updated : 2025-03-14 16:15
NVD link : CVE-2023-41916
Mitre link : CVE-2023-41916
JSON object : View
Products Affected
apache
- linkis
CWE
No CWE.