Vulnerability · Published Jul 15, 2024 · Assigned by apache
CVE-2023-46801Apache Linkis DataSource: DataSource Remote code execution vulnerability
High 8.8
In plain English
A high-severity unsafe deserialization in Apache Linkis DataSource from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject malicious files into the server and execute them. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. We recommend that users upgrade the java version to >= 1.8.0_241. Or users upgrade Linkis to version 1.6.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.linkis:linkis-datasource | 1.6.0 | GHSA-jjvc-v8gw-5255 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Linkis DataSource | 1.4.0 – before 1.6.0 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H