GitHub Advisoryadvisory · Maven

GHSA-x84r-jrqm-3hj8 Apache Linkis Unrestricted File Upload vulnerability

CRITICAL Published 2023-07-06 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-27602
Ecosystem
Maven
Packages
org.apache.linkis:linkis
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2023-07-06

Affected packages

• Maven org.apache.linkis:linkis: < 1.3.2 → fixed in 1.3.2

Description

In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users upgrade the version of Linkis to version 1.3.2.  For versions <=1.3.1, we suggest turning on the file path check switch in linkis.properties `wds.linkis.workspace.filesystem.owner.check=true` `wds.linkis.workspace.filesystem.path.check=true`

Related

Alias · CVE (1)

  • CVE-2023-27602 In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References