Lucene search

ApacheCVELIST:CVE-2022-39944

HistoryOct 26, 2022 - 12:00 a.m.

CVE-2022-39944 The Apache Linkis JDBC EngineConn module has a RCE Vulnerability

2022-10-2600:00:00

apache

www.cve.org

cve-2022-39944

apache linkis

rce vulnerability

mysql connector/j

deserialization

remote code execution

blacklisted parameters

update 1.3.0

AI Score

9.1

Confidence

High

EPSS

0.002

Percentile

59.3%

JSON

In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.2.0 will be affected, We recommend users to update to 1.3.0.

CNA Affected

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Linkis",
    "versions": [
      {
        "version": "Apache Linkis",
        "status": "affected",
        "lessThanOrEqual": "1.2.0",
        "versionType": "custom"
      }
    ]
  }
]

References

lists.apache.org/thread/rxytj48q17304snonjtyt5lnlw64gccc