CVE-2022-44645

Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability

In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected.We recommend users to upgrade the version of Linkis to version 1.3.1.

Affected

Apache Software Foundation · Apache Linkis (incubating)

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.93% chance of exploitation in the next 30 days, 80th percentile

Published

2023-01-31

Updated

2025-03-27

Vulhub environments (1)

• vulhub/vulhub/tree/master/linkis/CVE-2022-44645

Security advisories

• https://lists.apache.org/thread/zlcfmvt65blqc4n6fxypg6f0ns8fqfz4
• advisories/GHSA-h6w8-52mq-4qxc

References

• CVE Record
• NVD entry