Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Apache Linkis allows attackers to read local files

CVE-2022-44644 · published 3 years ago
Summary

Versions of Apache Linkis up to 1.3.0 let a logged‑in user read any file on the server by tricking the system into talking to a fake MySQL server. This happens because the software does not block a setting that enables local file loading. Upgrade to Linkis 1.3.1 or later and remove the unsafe setting from JDBC connection strings.

What to do
  • Update apache org.apache.linkis:linkis to version 1.3.1.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.linkis:linkis < 1.3.1
Fix: upgrade to 1.3.1
– apache linkis <= 1.3.0
cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:*
Original advisory text
Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, the parameters in the JDBC URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. 

We recommend users upgrade the version of Linkis to version 1.3.1
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-200Information Exposure
CWE-312Cleartext Storage of Sensitive Information
Timeline
Published31 Jan 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-rx76-xw35-6rh8 · GHSA
CVE-2022-44644 · NVD
CVE-2022-44644 · OSV
Track software like this
Free during beta