CVE-2024-27181: Apache Linkis Privilege Escalation Vulnerability
Summary
CVE-2024-27181: Apache Linkis vulnerable to privilege escalation. Affects org.apache.linkis:linkis versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Linkis is an open-source project that provides a unified big data platform for data processing and analysis. It offers basic management services and token-based authentication for secure access. However, versions up to 1.5.0 are vulnerable to privilege escalation, allowing attackers with trusted accounts to gain unauthorized access to Linkis's Token information.
Vulnerability Detail
The privilege escalation vulnerability in Apache Linkis allows attackers with trusted accounts to elevate their privileges and access sensitive Token information. This can lead to unauthorized actions and potential data breaches. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level. It is categorized as CWE-269.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Apache Linkis as soon as possible.
Conclusion
The privilege escalation vulnerability in Apache Linkis allows attackers with trusted accounts to gain unauthorized access to Token information. Upgrading to version 1.6.0 or later is crucial to mitigate this vulnerability and ensure the security of the Apache Linkis platform.
See every vulnerability recorded for org.apache.linkis:linkis →
FAQ
Apache Linkis is an open-source project that provides a unified big data platform for data processing and analysis.
Privilege escalation is the act of exploiting a vulnerability or design flaw to gain higher privileges than intended. In the case of Apache Linkis, it allows attackers with trusted accounts to elevate their privileges and access sensitive Token information.
This vulnerability can lead to unauthorized access to sensitive Token information, potentially resulting in data breaches and unauthorized actions within the Apache Linkis platform.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade your Apache Linkis installation to version 1.6.0 or later, which includes the necessary security patches and mitigations.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.linkis:linkis.
