PT-2023-22210

CVE-2023-29216

Published

2023-04-10

Updated

2024-10-22

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.3.1 and earlier

Description The issue arises because parameters are not effectively filtered in Apache Linkis, allowing an attacker to use the MySQL data source and malicious parameters to configure a new data source. This triggers a deserialization vulnerability, eventually leading to remote code execution.

Recommendations For Apache Linkis versions 1.3.1 and earlier, upgrade the version of Linkis to version 1.3.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Sw0Rd1Ight

Vendors

Affected products

Weakness enumeration

CWE-502: Deserialization of Untrusted Data

Related identifiers