CVE-2023-41916: Apache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file reading
First published: Sat Jul 13 2024(Updated: )
In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis = 1.4.0 will be affected. We recommend users upgrade the version of Linkis to version 1.5.0.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.linkis:linkis-datasource | >=1.4.0<1.6.0 | 1.6.0 |
| Apache Linkis | >=1.4.0<1.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-41916?
CVE-2023-41916 is considered to have a high severity due to the potential for arbitrary file reading through malicious JDBC parameters.
How do I fix CVE-2023-41916?
To fix CVE-2023-41916, update Apache Linkis to version 1.6.0 or later, which includes a blacklist for malicious parameters.
What versions of Apache Linkis are affected by CVE-2023-41916?
Apache Linkis versions from 1.4.0 up to 1.6.0 are affected by CVE-2023-41916.
What type of vulnerability is CVE-2023-41916?
CVE-2023-41916 is a code injection vulnerability that allows attackers to read arbitrary files.
Is my DataSource Manager Module vulnerable to CVE-2023-41916?
If you are using Apache Linkis versions 1.4.0 to 1.6.0, your DataSource Manager Module is vulnerable to CVE-2023-41916.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2023-41916
- agent/first-publish-date
- agent/title
- agent/weakness
- agent/type
- agent/references
- agent/description
- agent/author
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/softwarecombine
- collector/nvd-cve
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-f22j-9j59-33j4
- agent/last-modified-date
- collector/github-advisory
- agent/tags
- agent/trending
- agent/source
- vendor/apache
- canonical/apache linkis
- version/apache linkis/1.4.0
- package-manager/maven