CVE-2023-41916: medium-severity vulnerability in Apache Linkis DataSource
Apache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file reading
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.7%
In Apache Linkis =1.4.0, due to the lack of effective filtering
of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis = 1.4.0 will be affected.
We recommend users upgrade the version of Linkis to version 1.5.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Apache Software Foundation · Apache Linkis DataSourceRelated CVEs — Apache Linkis DataSource
In the same product, most dangerous first.
CVE-2023-46801HIGHApache Linkis DataSource: DataSource Remote code execution vulnerabilityEPSS 1.2%CVE-2023-50740MEDIUMApache Linkis DataSource: DataSource module Oracle SQL Database Password LoggedEPSS 0.9%CVE-2023-49566HIGHApache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerabilityEPSS 0.8%