High severity8.8NVD Advisory· Published Jul 15, 2024· Updated Jun 17, 2026
CVE-2023-49566
CVE-2023-49566
Description
In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious
db2
parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted.
This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out.
Versions of Apache Linkis
<=1.5.0
will be affected. We recommend users upgrade the version of Linkis to version 1.6.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.linkis:linkis-datasourceMaven | < 1.6.0 | 1.6.0 |
Affected products
3- Apache Software Foundation/Apache Linkis DataSourcev5Range: *
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-7qpc-4xx9-x5qwghsaADVISORY
- lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xjnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-49566ghsaADVISORY
- www.openwall.com/lists/oss-security/2024/07/13/5nvdWEB
- linkis.apache.org/download/release-notes-1.6.0ghsaWEB
News mentions
0No linked articles in our index yet.