CVE-2023-50740mediumCWE-532

CVE-2023-50740: medium-severity vulnerability in Apache Linkis DataSource

Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged

Published · Updated

Follow this CVE+ Monitor Apache Linkis DataSource+ Monitor org.apache.linkis:linkis

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.9%
In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module.  We recommend users upgrade the version of Linkis to version 1.5.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Apache Software Foundation · Apache Linkis DataSource
Related CVEs — Apache Linkis DataSource

In the same product, most dangerous first.

CVE-2023-46801HIGHApache Linkis DataSource: DataSource Remote code execution vulnerabilityEPSS 1.2%CVE-2023-49566HIGHApache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerabilityEPSS 0.8%CVE-2023-41916MEDIUMApache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file readingEPSS 0.7%