CVE-2023-41916

Katalog CVE

CVSS 6.5 · Medium EPSS 0,73%

Kerentanan Files or Directories Accessible to External Parties pada apache linkis. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis = 1.4.0 will be affected.  We recommend users upgrade the version of Linkis to version 1.5.0.

Rincian

Terbit di NVD

15 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 52,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2024/07/13/4