org.apache.linkis:linkis
Maven9 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting org.apache.linkis:linkispage 1 of 1
- CVE-2022-39944HIGHCVSS 8.8EG 8.8✓ Fixed in 1.3.02022-10-26
vulnerable: 1.0.3 ... 1.2.0 (6 versions)
In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data sou…
- CVE-2022-44644MEDIUMCVSS 6.5EG 6.5✓ Fixed in 1.3.12023-01-31
vulnerable: 1.0.3 ... 1.3.0 (7 versions)
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC para…
- CVE-2022-44645HIGHCVSS 8.8EG 8.8✓ Fixed in 1.3.12023-01-31
vulnerable: 1.0.3 ... 1.3.0 (7 versions)
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL dat…
- CVE-2023-27602CRITICALCVSS 9.8EG 9.8✓ Fixed in 1.3.22023-04-10
vulnerable: 1.0.3 ... 1.3.1 (8 versions)
In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users upgrade the version of Linkis to version 1.3.2. For versions <=1.3.1, we s…
- CVE-2023-27603CRITICALCVSS 9.8EG 9.8✓ Fixed in 1.3.22023-04-10
vulnerable: 1.0.3 ... 1.3.1 (8 versions)
In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability. We recommend users upgrade the version of Linkis…
- CVE-2023-27987CRITICALCVSS 9.1EG 9.1✓ Fixed in 1.3.22023-04-10
vulnerable: 1.0.3 ... 1.3.1 (8 versions)
In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values. We recommend…
- CVE-2023-50740MEDIUMCVSS 5.3EG 5.3✓ Fixed in 1.5.02024-03-06
vulnerable: 1.0.3 ... 1.4.0 (10 versions)
In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0
- CVE-2024-27181HIGHCVSS 8.8EG 8.8✓ Fixed in 1.6.02024-08-02
vulnerable: 1.0.3 ... 1.5.0 (11 versions)
In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this is…
- CVE-2024-27182MEDIUMCVSS 4.9EG 4.9✓ Fixed in 1.6.02024-08-02
vulnerable: 1.0.3 ... 1.5.0 (11 versions)
In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any file accessible by the Linkis system user . Users are recommended to upgrade to version 1.6.0, whi…
Check whether org.apache.linkis:linkis is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.apache.linkis:linkis CVEs against the assets you own.
Start Free Scan →