CVE-2024-45627

Katalog CVE

CVSS 5.9 · Medium EPSS 0,32%

Kerentanan Files or Directories Accessible to External Parties pada apache linkis. Skor CVSS 3.1 5.9 (Medium) menurut CISA ADP.

Deskripsi (NVD)

In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis < 1.7.0 will be affected. We recommend users upgrade the version of Linkis to version 1.7.0.

Rincian

Terbit di NVD

14 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/0zzx8lldwoqgzq98mg61hojgpvn76xsh advisory vendor
• http://www.openwall.com/lists/oss-security/2025/01/14/1 mailing list