Remote Code Execution (RCE)

2023-04-1206:52:55

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

remote code execution

apache linkis

malicious parameters

insecure deserialization

mysql data source

0.024 Low

EPSS

Percentile

89.9%

JSON

org.apache.linkis:linkis-datasource is vulnerable to Remote Code Execution (RCE). A remote attacker is able to upload and execute malicious code on the system, using MySQL data source and malicious parameters to configure a new data source which triggers insecure deserialization.

CPENameOperatorVersion
linkis-datasourcele1.3.1
linkis-datasourcele1.3.1

CPE	Name	Operator	Version
	linkis-datasource	le	1.3.1
	linkis-datasource	le	1.3.1

References

www.openwall.com/lists/oss-security/2023/04/10/5

github.com/advisories/GHSA-rrhf-32rq-f28h

github.com/apache/linkis/commit/7005c01d7f7bca78322447f4f2f32b8398645687

linkis.apache.org/download/release-notes-1.3.2/

lists.apache.org/thread/18vv0m32oy51nzk8tbz13qdl5569y55l

0.024 Low

EPSS

Percentile

89.9%

JSON

Related for VERACODE:40118