PT-2023-8820 · Apache · Apache Linkis

Jonathan Leitschuh · Published 2023-12-13 · Updated 2024-11-08 · CVE-2023-50740

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Linkis versions <=1.4.0

Description The issue is related to insufficient protection of registration data in Apache Linkis, which may allow a remote attacker to gain unauthorized access to protected information. Specifically, when using the Oracle data source of the Linkis data source module, the password is printed to the log.

Recommendations For Apache Linkis versions <=1.4.0, upgrade the version of Linkis to version 1.5.0 to resolve the issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2024-02069

CVE-2023-50740

GHSA-M757-P8RV-4Q93

Affected Products

Apache Linkis

References · 11

• https://osv.dev/vulnerability/GHSA-m757-p8rv-4q93 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50740 · Security Note
• https://bdu.fstec.ru/vul/2024-02069 · Security Note
• https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50740 · Vendor Advisory
• https://github.com/apache/linkis · Note
• https://github.com/apache/linkis/commit/08cbcfca140afebae10e1582ee87721578719ded · Note
• https://cybersecurity-help.cz/vdb/SB2024031106 · Note
• https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELINKIS-6405835 · Note
• http://openwall.com/lists/oss-security/2024/03/06/2 · Note
• https://github.com/advisories/GHSA-m757-p8rv-4q93 · Note