High severity8.8NVD Advisory· Published Jul 15, 2024· Updated Jun 17, 2026
CVE-2023-46801
CVE-2023-46801
Description
In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject malicious files into the server and execute them.
This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. We recommend that users upgrade the java version to >= 1.8.0_241. Or users upgrade Linkis to version 1.6.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.linkis:linkis-datasourceMaven | >= 1.4.0, < 1.6.0 | 1.6.0 |
Affected products
3- Apache Software Foundation/Apache Linkis DataSourcev5Range: 1.4.0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-jjvc-v8gw-5255ghsaADVISORY
- lists.apache.org/thread/0dnzh64xy1n7qo3rgo2loz9zn7m9xgdxnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-46801ghsaADVISORY
- linkis.apache.org/download/release-notes-1.6.0ghsaWEB
- www.openwall.com/lists/oss-security/2024/07/13/6nvd
News mentions
0No linked articles in our index yet.