CVE-2023-49566

In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj	Mailing List Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-07-15 08:15

Updated : 2024-07-16 18:06

NVD link : CVE-2023-49566

Mitre link : CVE-2023-49566

CVE.ORG link : CVE-2023-49566

JSON object : View

Products Affected

apache

linkis

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2023-49566", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-07-15T08:15:02.367", "references": [{"url": "https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "\nIn Apache Linkis <=1.5.0, due to the lack of effective filtering\nof parameters, an attacker configuring malicious \n\ndb2\n\n parameters in the DataSource Manager Module will result\u00a0in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted.\u00a0\n\nThis attack requires the attacker to obtain an authorized account from Linkis before it can be carried out.\n\n Versions of Apache Linkis \n\n<=1.5.0\n\n will be affected.\nWe recommend users upgrade the version of Linkis to version 1.6.0.\n"}, {"lang": "es", "value": "En Apache Linkis <= 1.5.0, debido a la falta de un filtrado efectivo de par\u00e1metros, un atacante que configure par\u00e1metros db2 maliciosos en el m\u00f3dulo DataSource Manager resultar\u00e1 en una inyecci\u00f3n de jndi. Por lo tanto, los par\u00e1metros en la URL de DB2 deben estar en la lista negra. Este ataque requiere que el atacante obtenga una cuenta autorizada de Linkis antes de poder llevarse a cabo. Las versiones de Apache Linkis <=1.5.0 se ver\u00e1n afectadas. Recomendamos a los usuarios actualizar la versi\u00f3n de Linkis a la versi\u00f3n 1.6.0."}], "lastModified": "2024-07-16T18:06:05.347", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F9BA8E6-F548-4333-989B-33F7B4362998", "versionEndExcluding": "1.6.0", "versionStartIncluding": "1.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}