GHSA-rrhf-32rq-f28hCriticalCVSS 9.8

Apache Linkis DatasourceManager module has deserialization vulnerability

Published
April 10, 2023
Last Modified
February 13, 2025

🔗 CVE IDs covered (1)

📋 Description

In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker can use the MySQL data source and malicious parameters to configure a new data source to trigger a deserialization vulnerability, eventually leading to remote code execution. Users should upgrade their version of Linkis to version 1.3.2.

🎯 Affected products1

  • maven/org.apache.linkis:linkis-datasource:< 1.3.2

🔗 References (5)