GitHub Advisoryadvisory · Maven

GHSA-pj5j-w7mw-w797 Apache Linkis Zip Slip issue

CRITICAL Published 2023-07-06 Modified 2024-10-22 Official page ↗
Aliases
CVE-2023-27603
Ecosystem
Maven
Packages
org.apache.linkis:linkis
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22, CWE-434
Reviewed
2023-07-06

Affected packages

• Maven org.apache.linkis:linkis: < 1.3.2 → fixed in 1.3.2

Description

In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability. We recommend users upgrade the version of Linkis to version 1.3.2.

Related

Alias · CVE (1)

  • CVE-2023-27603 In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References