CVE-2022-44644
published 2023-01-31CVE-2022-44644: In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by…
PriorityP338medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.16%
63.6th percentile
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, the parameters in the JDBC URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected.
We recommend users upgrade the version of Linkis to version 1.3.1
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | linkis | <= 1.3.0 | — |
| apache_software_foundation | apache_linkis | < 1.3.1 | 1.3.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Linkis vulnerable to Exposure of Sensitive Information
ghsa·2023-01-31
CVE-2022-44644 [MEDIUM] CWE-20 Apache Linkis vulnerable to Exposure of Sensitive Information
Apache Linkis vulnerable to Exposure of Sensitive Information
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, an authenticated attacker could read arbitrary local file by connecting a rogue mysql server, By adding allowLoadLocalInfile to true in the jdbc parameter. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.1
OSV
Apache Linkis vulnerable to Exposure of Sensitive Information
osv·2023-01-31
CVE-2022-44644 [MEDIUM] Apache Linkis vulnerable to Exposure of Sensitive Information
Apache Linkis vulnerable to Exposure of Sensitive Information
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, an authenticated attacker could read arbitrary local file by connecting a rogue mysql server, By adding allowLoadLocalInfile to true in the jdbc parameter. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.1
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-01-31
Published