Linkis <=1.5.0 Vulnerable to JNDI Injection due to Inadequate Parameter Filtering
CVE-2023-49566

8.8HIGH

Key Information:

Vendor

Apache
Status
Apache Linkis Datasource
Vendor
CVE Published:
15 July 2024

What is CVE-2023-49566?

In Apache Linkis versions up to 1.5.0, a vulnerability arises from insufficient filtering of parameters in the DataSource Manager Module, allowing an attacker with an authorized account to introduce malicious DB2 parameters leading to jndi injection. To mitigate this risk, it is recommended to blacklist parameters within the DB2 URL. Users are advised to upgrade to version 1.6.0 of Apache Linkis for enhanced security.

Affected Version(s)

Apache Linkis DataSource * < 1.6.0

References

https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwv...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

Credit

Joyh
L0ne1y
.