WaratekVRT Sign in

High Org.apache.linkis CVEs

7 CVEs, 5 protected by Waratek

Reset
More filters (1)
Columns
Vendor org.apache.linkis✕
Overview 7 matches · 5 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
7matches 5protected71.4% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 5 71.4% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 28.6%
Critical 0 0.0% High 7 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 71.4% partly blocked 0 0.0% not blocked 2 28.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 100.0%
split by peak 4 / quarter
No exploit published: 2Protected by Waratek: 5 High: 7 not blocked: 2blocked by ARMR today: 5 No public exploit: 7
Q4 221 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q1 231 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q2 230 Q3 230 Q4 230 Q1 240 Q2 240 Q3 244 Protected by Waratek2 No exploit published2 High4 blocked by ARMR today2 not blocked2 No public exploit4 Q4 240 Q1 250 Q2 250 Q3 250 Q4 250 Q1 261 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
Q1 23Q3 23Q1 24Q3 24Q1 25Q3 25Q1 26
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-29847 High 2026-01-19 Protected by Waratek No public exploit A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL parameter configured on the frontend has undergone multiple rounds of URL encoding, it may bypass the system's checks. This bypass can trigger a vulnerability that allows unauthorized access to system files via JDBC parameters. Scope of Impact This issue affects Apache Linkis: from 1.3.0 through 1.7.0. Severity level moderate Solution Continuously check if the connection information contains the "%" character; if it does, perform URL decoding. Users are recommended to upgrade to version 1.8.0, which fixes the issue. More questions about this vulnerability can be discussed here:  https://lists.apache.org/list?dev@linkis.apache.org:2025-9:cve
CVE-2024-39928 High 2024-09-25 No exploit published No public exploit In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils. Users are recommended to upgrade to version 1.6.0, which fixes this issue.
CVE-2024-27181 High 2024-08-02 No exploit published No public exploit In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.
CVE-2023-49566 High 2024-07-15 Protected by Waratek No public exploit In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted.  This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0.
CVE-2023-46801 High 2024-07-15 Protected by Waratek No public exploit In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject malicious files into the server and execute them. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out.  We recommend that users upgrade the java version to >= 1.8.0_241. Or users upgrade Linkis to version 1.6.0.
CVE-2022-44645 High 2023-01-31 Protected by Waratek No public exploit In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users to upgrade the version of Linkis to version 1.3.1.
CVE-2022-39944 High 2022-10-26 Protected by Waratek No public exploit In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.2.0 will be affected, We recommend users to update to 1.3.0.