We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2023-27987

Apache Linkis gateway module token authentication bypass



Assignerapache
Reserved2023-03-09
Published2023-04-10
Updated2024-10-17

Description

In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values. We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization[1] https://linkis.apache.org/docs/latest/auth/token https://linkis.apache.org/docs/latest/auth/token

Product status

Default status
unaffected

Any version
affected

Credits

Laihan reporter

References

https://lists.apache.org/thread/3cr1cz3210wzwngldwrqzm43vwhghp0p vendor-advisory mailing-list

https://www.openwall.com/lists/oss-security/2023/04/10/3

cve.org CVE-2023-27987

nvd.nist.gov CVE-2023-27987

Download JSON

Share this page
https://cve.threatint.com
Subscribe to our newsletter to learn more about our work.