Deserialization in Apache Linkis
CVE-2023-46801
In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject malicious files into the server and execute them. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. We recommend that users upgrade the java version to >= 1.8.0_241. Or users upgrade Linkis to version 1.6.0.
Vulnerability class: Insecure Deserialization
EPSS: 0.012 (65.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Linkis
- Apache Software Foundation Linkis Datasource — versions 1.4.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2023-46801?
- CVE-2023-46801 is a high-severity vulnerability in Apache Linkis, classified under Deserialization of Untrusted Data. CVSS score: 8.8/10. Published 2024-07-15.
- How severe is CVE-2023-46801?
- High severity. CVSS v3 base score is 8.8 out of 10.