Deserialization in Apache Linkis
CVE-2023-46801
In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject malicious files into the server and execute them. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. We recommend that users upgrade the java version to >= 1.8.0_241. Or users upgrade Linkis to version 1.6.0.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.012 (67.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 68th percentile — 67.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.012 · change: 0.000
Affected products
- Apache Linkis
- Apache Software Foundation Linkis Datasource — versions 1.4.0
Weakness classification (CWE)
References
- lists.apache.org/thread/0dnzh64xy1n7qo3rgo2loz9zn7m9xgdx (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2023-46801?
- CVE-2023-46801 is a high-severity vulnerability in Apache Linkis, classified under Deserialization of Untrusted Data. CVSS score: 8.8/10. Published 2024-07-15.
- How severe is CVE-2023-46801?
- High severity. CVSS v3 base score is 8.8 out of 10.