GHSA-rrhf-32rq-f28hCriticalCVSS 9.8
Apache Linkis DatasourceManager module has deserialization vulnerability
🔗 CVE IDs covered (1)
📋 Description
In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker can use the MySQL data source and malicious parameters to configure a new data source to trigger a deserialization vulnerability, eventually leading to remote code execution. Users should upgrade their version of Linkis to version 1.3.2.
🎯 Affected products1
- maven/org.apache.linkis:linkis-datasource:< 1.3.2