PT-2023-21469 · Apache · Apache Linkis

Laihan · Published 2023-04-10 · Updated 2024-10-17 · CVE-2023-27987

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.3.1 and earlier

Description The issue arises due to the default token generated by Linkis Gateway deployment being too simple, making it easy for attackers to obtain the default token for the attack. Generation rules should add random values.

Recommendations For Apache Linkis versions 1.3.1 and earlier, upgrade the version of Linkis to version 1.3.2 and modify the default token value. As a temporary workaround, consider modifying the default token value to add random values until a patch is available. Restrict access to the default token to minimize the risk of exploitation.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-294

CWE-326

Related Identifiers

CVE-2023-27987

GHSA-4X5H-XMV4-99WX

Affected Products

Apache Linkis

References · 8

• https://osv.dev/vulnerability/GHSA-4x5h-xmv4-99wx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27987 · Security Note
• https://lists.apache.org/thread/3cr1cz3210wzwngldwrqzm43vwhghp0p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27987 · Vendor Advisory
• https://github.com/apache/linkis · Note
• https://t.me/cibsecurity/61738 · Telegram Post
• https://linkis.apache.org/docs/latest/auth/token · Note
• https://openwall.com/lists/oss-security/2023/04/10/3 · Note