CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49566 – Apache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerability
https://notcve.org/view.php?id=CVE-2023-49566
In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0. En Apache Linkis <= 1.5.0, debido a la falta de un filtrado efectivo de parámetros, un atacante que configure parámetros db2 maliciosos en el módulo DataSource Manager resultará en una inyección de jndi. Por lo tanto, los parámetros en la URL de DB2 deben estar en la lista negra. Este ataque requiere que el atacante obtenga una cuenta autorizada de Linkis antes de poder llevarse a cabo. • https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46801 – Apache Linkis DataSource: DataSource Remote code execution vulnerability
https://notcve.org/view.php?id=CVE-2023-46801
In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject malicious files into the server and execute them. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. We recommend that users upgrade the java version to >= 1.8.0_241. Or users upgrade Linkis to version 1.6.0. En Apache Linkis <= 1.5.0, el módulo de administración de fuentes de datos, al agregar una fuente de datos Mysql, existe una vulnerabilidad de ejecución remota de código para la versión de Java <1.8.0_241. • https://lists.apache.org/thread/0dnzh64xy1n7qo3rgo2loz9zn7m9xgdx • CWE-502: Deserialization of Untrusted Data •
CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41916 – Apache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file reading
https://notcve.org/view.php?id=CVE-2023-41916
In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis = 1.4.0 will be affected. We recommend users upgrade the version of Linkis to version 1.5.0. En Apache Linkis = 1.4.0, debido a la falta de filtrado efectivo de parámetros, un atacante que configure parámetros maliciosos de Mysql JDBC en el módulo DataSource Manager activará la lectura de archivos arbitrarios. • https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729 • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50740 – Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged
https://notcve.org/view.php?id=CVE-2023-50740
In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0 En Apache Linkis <= 1.4.0, la contraseña se imprime en el registro cuando se utiliza la fuente de datos de Oracle del módulo de fuente de datos de Linkis. Recomendamos a los usuarios actualizar la versión de Linkis a la versión 1.5.0 • http://www.openwall.com/lists/oss-security/2024/03/06/2 https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo • CWE-532: Insertion of Sensitive Information into Log File •