GitHub Advisoryadvisory · Maven

GHSA-4x5h-xmv4-99wx Apache Linkis Authentication Bypass vulnerability

CRITICAL Published 2023-07-06 Modified 2024-10-18 Official page ↗
Aliases
CVE-2023-27987
Ecosystem
Maven
Packages
org.apache.linkis:linkis
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-294, CWE-326
Reviewed
2023-07-06

Affected packages

• Maven org.apache.linkis:linkis: < 1.3.2 → fixed in 1.3.2

Description

In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values. We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization.

Related

Alias · CVE (1)

  • CVE-2023-27987 In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to… vulnerability

Weakness · CWE (2)

  • CWE-294 Authentication Bypass by Capture-replay weakness
  • CWE-326 Inadequate Encryption Strength weakness

References