CVE-2023-29216
Assigner: apache
Published: 2023-04-10T07:37:29.383Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Linkis
vendor: Apache Software Foundation
versions: lessThanOrEqual: 1.3.1
status: affected
version: 0
versionType: maven
credits: type: reporter
value: sw0rd1ight
descriptions: supportingMedia: base64: no
type: text/html
value: 

In Apache Linkis &lt;=1.3.1, because the parameters are not
effectively filtered, the attacker uses the MySQL data source and malicious parameters to
configure a new data source to trigger a deserialization vulnerability, eventually leading to
remote code execution.<br> Versions of Apache Linkis &lt;= 1.3.0 will be affected.<br>We recommend users upgrade the version of Linkis to version 1.3.2.

<br>
value: 
In Apache Linkis <=1.3.1, because the parameters are not
effectively filtered, the attacker uses the MySQL data source and malicious parameters to
configure a new data source to trigger a deserialization vulnerability, eventually leading to
remote code execution.
 Versions of Apache Linkis <= 1.3.0 will be affected.
We recommend users upgrade the version of Linkis to version 1.3.2.



metrics: other: content: text: important
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-502
description: CWE-502 Deserialization of Untrusted Data
type: CWE
source: discovery: EXTERNAL
title: Apache Linkis DatasourceManager module has a deserialization command execution
x_generator: engine: Vulnogram 0.1.0-dev