PT-2023-21244 · Apache · Apache Linkis

4Ra1N

·

CVE-2023-27603

·

Publicado

2023-04-10

·

Atualizado

2024-10-22

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.3.1 and earlier
Description The issue is related to a Zip Slip problem in the Manager module engineConn material upload, which does not check the zip path. This can lead to a potential RCE vulnerability.
Recommendations For Apache Linkis versions 1.3.1 and earlier, upgrade the version of Linkis to version 1.3.2.

Exploit

Correção

Path traversal

Unrestricted File Upload

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22CWE-434

Identificadores relacionados

CVE-2023-27603
GHSA-PJ5J-W7MW-W797

Produtos afetados

Apache Linkis