CVE-2023-27602

published 2023-04-10

CVE-2023-27602: In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types.

We recommend users upgrade the version of Linkis to version 1.3.2.

For versions

<=1.3.1, we suggest turning on the file path check switch in linkis.properties

`wds.linkis.workspace.filesystem.owner.check=true`
`wds.linkis.workspace.filesystem.path.check=true`

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	linkis	<= 1.3.1	—
apache_software_foundation	apache_linkis	<= 1.3.1	—

CWE-434