CVE-2023-27987

Katalog CVE

CVSS 9.1 · Critical EPSS 0,81%

Kerentanan Inadequate Encryption Strength pada apache linkis. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values. We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization[1] https://linkis.apache.org/docs/latest/auth/token https://linkis.apache.org/docs/latest/auth/token

Rincian

Terbit di NVD

10 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-326: Inadequate Encryption Strength

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/3cr1cz3210wzwngldwrqzm43vwhghp0p mailing list · advisory vendor
• https://www.openwall.com/lists/oss-security/2023/04/10/3 mailing list