AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

linkisGHSA-v352-rg37-5q5m

Apache Linkis vulnerable to privilege escalation

linkis

CVE-2024-27181 · Published Aug 2, 2024 · updated Jun 4, 2025

High5.3
Fix: upgrade to 1.6.0 or later
GitHub advisory

In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.

Affected versions

PackageAffectedFixed in
org.apache.linkis:linkis
Maven
< 1.6.01.6.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-269
Also known as
CVE-2024-27181

More linkis advisories

All linkis
High 7.5Jan 19Apache Linkis: Arbitrary File Read via Double URL Encoding BypassCVE-2025-29847fixed in 1.8.0High 4.9Aug 2, 2024Apache Linkis arbitrary file deletion vulnerabilityCVE-2024-27182fixed in 1.6.0Medium 5.3Mar 6, 2024Apache Linkis DataSource: DataSource module Oracle SQL Database Password LoggedCVE-2023-50740fixed in 1.5.0Critical 9.1Jul 6, 2023Apache Linkis Authentication Bypass vulnerabilityCVE-2023-27987fixed in 1.3.2Critical 9.8Jul 6, 2023Apache Linkis Zip Slip issueCVE-2023-27603fixed in 1.3.2Critical 9.8Jul 6, 2023Apache Linkis Unrestricted File Upload vulnerabilityCVE-2023-27602fixed in 1.3.2