PT-2023-22210

CVE-2023-29216

Publicado

2023-04-10

Atualizado

2024-10-22

Descrição por

CVSS 3.1

9.8

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.3.1 and earlier

Description The issue arises because parameters are not effectively filtered in Apache Linkis, allowing an attacker to use the MySQL data source and malicious parameters to configure a new data source. This triggers a deserialization vulnerability, eventually leading to remote code execution.

Recommendations For Apache Linkis versions 1.3.1 and earlier, upgrade the version of Linkis to version 1.3.2.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Sw0Rd1Ight

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-502: Deserialization of Untrusted Data

Identificadores relacionados