PT-2024-21716 · Apache · Apache Linkis

Superx · Published 2024-08-02 · Updated 2024-08-02 · CVE-2024-27181

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Linkis versions 1.5.0 and earlier

Description The issue allows a trusted account to escalate privileges in Basic management services, gaining access to Linkis's Token information.

Recommendations For Apache Linkis versions 1.5.0 and earlier, upgrade to version 1.6.0 to resolve the issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-27181

GHSA-V352-RG37-5Q5M

Affected Products

Apache Linkis

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-27181 · Security Note
• https://lists.apache.org/thread/hosd73l7hxb3rpt5rb0yg0ld11zph4c6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27181 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v352-rg37-5q5m · Vendor Advisory
• https://github.com/apache/linkis · Note
• https://t.me/cvedetector/2341 · Telegram Post
• https://openwall.com/lists/oss-security/2024/08/02/3 · Note
• http://openwall.com/lists/oss-security/2024/08/02/3 · Note