CVE-2023-27603

Description

In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a potential RCE vulnerability. We recommend users upgrade the version of Linkis to version 1.3.2.

Reserved 2023-03-04 | Published 2023-04-10 | Updated 2024-10-22 | Assigner apache

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status
unaffected

Any version
affected

Credits

4ra1n reporter

References

lists.apache.org/thread/6n1vlvnyn441rm02zdqc0wnpckj8ltn8 mailing-list vendor-advisory

www.openwall.com/lists/oss-security/2023/04/10/2

cve.org (CVE-2023-27603)

nvd.nist.gov (CVE-2023-27603)

Download JSON