CVE-2024-27181 Apache Linkis Basic management services: Privilege Escalation Attack vulnerability

What is CVE-2024-27181?

CVE-2024-27181 is a high-severity vulnerability in Apache Linkis Basic management services, published on 2 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Apache Linkis <= 1.5.0,

Privilege Escalation in Basic management services where the attacking user is

a trusted account

allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.

Weakness: CWE-269

Which versions are affected by CVE-2024-27181?

2 open source packages ship an affected version, including org.apache.linkis:linkis. It affects 1 product.

Products include Apache Linkis.

How do I fix CVE-2024-27181?

Upgrade org.apache.linkis:linkis to 1.6.0 or later.

Is CVE-2024-27181 being exploited?

There is no known exploitation of CVE-2024-27181 in the wild and no public exploit code.

Other vulnerabilities in Apache Linkis Basic management services

• CVE-2023-27602 Apache Linkis publicsercice module unrestricted upload of file Critical 9.8
• CVE-2023-27603 Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue Critical 9.8
• CVE-2023-29215 Apache Linkis JDBC EngineCon has a deserialization command execution Critical 9.8
• CVE-2023-29216 Apache Linkis DatasourceManager module has a deserialization command execution Critical 9.8
• CVE-2023-27987 Apache Linkis gateway module token authentication bypass Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v352-rg37-5q5m.