CVE-2024-27182 Apache Linkis Basic management services: Engine material management Arbitrary file deletion vulnerability

What is CVE-2024-27182?

CVE-2024-27182 is a medium-severity path traversal vulnerability in Apache Linkis Basic management services, published on 2 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

In Apache Linkis <= 1.5.0,

Arbitrary file deletion in Basic management services on

A user with an administrator account could delete any file accessible by the Linkis system user

. Users are recommended to upgrade to version 1.6.0, which fixes this issue.

Weakness: CWE-552

Which versions are affected by CVE-2024-27182?

2 open source packages ship an affected version, including org.apache.linkis:linkis. It affects 1 product.

Products include Apache Linkis.

How do I fix CVE-2024-27182?

Upgrade org.apache.linkis:linkis to 1.6.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-27182 being exploited?

There is no known exploitation of CVE-2024-27182 in the wild and no public exploit code.

Other vulnerabilities in Apache Linkis Basic management services

• CVE-2023-27602 Apache Linkis publicsercice module unrestricted upload of file Critical 9.8
• CVE-2023-27603 Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue Critical 9.8
• CVE-2023-29215 Apache Linkis JDBC EngineCon has a deserialization command execution Critical 9.8
• CVE-2023-29216 Apache Linkis DatasourceManager module has a deserialization command execution Critical 9.8
• CVE-2023-27987 Apache Linkis gateway module token authentication bypass Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j6vx-r77h-44wc.