CVE-2023-27602 Apache Linkis publicsercice module unrestricted upload of file

2023-04-1007:36:28

CWE-434

apache

www.cve.org

cve-2023-27602

apache linkis

unrestricted upload

AI Score

9.7

Confidence

High

EPSS

0.027

Percentile

90.5%

JSON

In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types.

We recommend users upgrade the version of Linkis to version 1.3.2.

For versions

<=1.3.1, we suggest turning on the file path check switch in linkis.properties

wds.linkis.workspace.filesystem.owner.check=true
wds.linkis.workspace.filesystem.path.check=true

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Linkis",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.3.1",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]