PT-2023-21469 · Apache · Apache Linkis

Laihan · Publicado 2023-04-10 · Atualizado 2024-10-17 · CVE-2023-27987

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.3.1 and earlier

Description The issue arises due to the default token generated by Linkis Gateway deployment being too simple, making it easy for attackers to obtain the default token for the attack. Generation rules should add random values.

Recommendations For Apache Linkis versions 1.3.1 and earlier, upgrade the version of Linkis to version 1.3.2 and modify the default token value. As a temporary workaround, consider modifying the default token value to add random values until a patch is available. Restrict access to the default token to minimize the risk of exploitation.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-294

CWE-326

Identificadores relacionados

CVE-2023-27987

GHSA-4X5H-XMV4-99WX

Produtos afetados

Apache Linkis

Referências · 8

• https://github.com/apache/linkis · Nota
• https://t.me/cibsecurity/61738 · Publicação no Telegram
• https://linkis.apache.org/docs/latest/auth/token · Nota
• https://openwall.com/lists/oss-security/2023/04/10/3 · Nota
• https://osv.dev/vulnerability/GHSA-4x5h-xmv4-99wx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-27987 · Nota de Segurança
• https://lists.apache.org/thread/3cr1cz3210wzwngldwrqzm43vwhghp0p · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-27987 · Aviso do Fabricante