CVE-2023-27987
published 2023-04-10CVE-2023-27987: In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default…
PriorityP348critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.81%
52.7th percentile
In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values.
We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization[1]
https://linkis.apache.org/docs/latest/auth/token https://linkis.apache.org/docs/latest/auth/token
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | linkis | <= 1.3.1 | — |
| apache_software_foundation | apache_linkis | <= 1.3.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Linkis Authentication Bypass vulnerability
osv·2023-07-06
CVE-2023-27987 [CRITICAL] Apache Linkis Authentication Bypass vulnerability
Apache Linkis Authentication Bypass vulnerability
In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values.
We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization.
GHSA
Apache Linkis Authentication Bypass vulnerability
ghsa·2023-07-06
CVE-2023-27987 [CRITICAL] CWE-294 Apache Linkis Authentication Bypass vulnerability
Apache Linkis Authentication Bypass vulnerability
In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values.
We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-04-10
Published