AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

linkisGHSA-4x5h-xmv4-99wx

Apache Linkis Authentication Bypass vulnerability

linkis

CVE-2023-27987 · Published Jul 6, 2023 · updated Oct 18, 2024

Critical9.1
Fix: upgrade to 1.3.2 or later
GitHub advisory

In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values.

We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization.

Affected versions

PackageAffectedFixed in
org.apache.linkis:linkis
Maven
< 1.3.21.3.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-294, CWE-326
Also known as
CVE-2023-27987

More linkis advisories

All linkis
Medium 5.3Mar 6, 2024Apache Linkis DataSource: DataSource module Oracle SQL Database Password LoggedCVE-2023-50740fixed in 1.5.0Critical 9.8Jul 6, 2023Apache Linkis Zip Slip issueCVE-2023-27603fixed in 1.3.2Critical 9.8Jul 6, 2023Apache Linkis Unrestricted File Upload vulnerabilityCVE-2023-27602fixed in 1.3.2High 8.8Jan 31, 2023Apache Linkis contains Deserialization of Untrusted DataCVE-2022-44645fixed in 1.3.1Medium 6.5Jan 31, 2023Apache Linkis vulnerable to Exposure of Sensitive InformationCVE-2022-44644fixed in 1.3.1High 8.8Oct 26, 2022Apache Linkis subject to Remote Code Execution via deserializationCVE-2022-39944fixed in 1.3.0