CVE-2023-27603
Assigner: apache
Published: 2023-04-10T07:36:50.250Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Linkis
vendor: Apache Software Foundation
versions: lessThanOrEqual: 1.3.1
status: affected
version: 0
versionType: maven
credits: type: reporter
value: 4ra1n
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">

In Apache Linkis &lt;=1.3.1, due to the Manager module engineConn material upload does not check the zip path,&nbsp;This is a Zip Slip issue, which will lead to a&nbsp;</span><span style="background-color: rgb(255, 255, 255);">potential RCE vulnerability.<br>

We recommend users upgrade the version of Linkis to version 1.3.2.

</span>


value: 


In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability.


We recommend users upgrade the version of Linkis to version 1.3.2.




metrics: other: content: text: important
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
type: CWE
source: discovery: EXTERNAL
title: Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue
x_generator: engine: Vulnogram 0.1.0-dev