CVE-2023-49566
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2023
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Apache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerability
In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Apache Linkis DataSource
- Vendor
- Apache Software Foundation
- Product
- Apache Linkis DataSource
- Platforms
- Unknown
- Default status
unaffected- Package
- org.apache.linkis:linkis-metadata-query-service-jdbc
- Package collection
- https://repo.maven.apache.org/maven2
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| * | affected | maven | 1.6.0 | Unavailable | None listed |