CVE-2023-27987

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-27987
In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values. We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization[1] https://linkis.apache.org/docs/latest/auth/token https://linkis.apache.org/docs/latest/auth/token

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/3cr1cz3210wzwngldwrqzm43vwhghp0p Mailing List Vendor Advisory
https://www.openwall.com/lists/oss-security/2023/04/10/3 Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:*
History

14 Apr 2023, 19:46

Type Values Removed Values Added
References (MISC) https://www.openwall.com/lists/oss-security/2023/04/10/3 - (MISC) https://www.openwall.com/lists/oss-security/2023/04/10/3 - Mailing List

14 Apr 2023, 08:15

Type Values Removed Values Added
References
  • {'url': 'http://www.openwall.com/lists/oss-security/2023/04/10/3', 'name': 'http://www.openwall.com/lists/oss-security/2023/04/10/3', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'MISC'}
  • (MISC) https://www.openwall.com/lists/oss-security/2023/04/10/3 -

14 Apr 2023, 03:50

Type Values Removed Values Added
References (MISC) https://lists.apache.org/thread/3cr1cz3210wzwngldwrqzm43vwhghp0p - (MISC) https://lists.apache.org/thread/3cr1cz3210wzwngldwrqzm43vwhghp0p - Mailing List, Vendor Advisory
References (MISC) http://www.openwall.com/lists/oss-security/2023/04/10/3 - (MISC) http://www.openwall.com/lists/oss-security/2023/04/10/3 - Mailing List, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.1
First Time Apache
Apache linkis
CWE CWE-294 CWE-326
CPE cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:*

10 Apr 2023, 13:37

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/04/10/3 -

10 Apr 2023, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-10 08:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-27987

Mitre link : CVE-2023-27987

CVE.ORG link : CVE-2023-27987

JSON object : View

Products Affected

apache

  • linkis
CWE
CWE-326

Inadequate Encryption Strength