Описание
In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a new data source to trigger a deserialization vulnerability, eventually leading to remote code execution. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.2.
Ссылки
- Mailing ListThird Party Advisory
- Mailing ListVendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.3.1 (включая)
cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:*
EPSS
Процентиль: 89%
0.04807
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-502
Связанные уязвимости
CVSS3: 9.8
github
почти 3 года назад
Apache Linkis DatasourceManager module has deserialization vulnerability
EPSS
Процентиль: 89%
0.04807
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-502