CVE-2023-27602: Apache Linkis publicsercice module unrestricted upload of file
In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types.
We recommend users upgrade the version of Linkis to version 1.3.2.
For versions
<=1.3.1, we suggest turning on the file path check switch in linkis.properties
wds.linkis.workspace.filesystem.owner.check=true wds.linkis.workspace.filesystem.path.check=true
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-27602?
CVE-2023-27602 has a moderate severity due to unrestricted file uploads in Apache Linkis.
How do I fix CVE-2023-27602?
To fix CVE-2023-27602, upgrade Apache Linkis to version 1.3.2.
What versions of Apache Linkis are affected by CVE-2023-27602?
CVE-2023-27602 affects Apache Linkis versions up to and including 1.3.1.
What security risks does CVE-2023-27602 pose?
CVE-2023-27602 poses risks such as unauthorized file access and potential server compromise due to unrestricted file uploads.
Is there a workaround for CVE-2023-27602 if I cannot upgrade?
Yes, enabling the file path check switch can serve as a temporary workaround for CVE-2023-27602.