PatchTheCVECVE-2024-45627: In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicio
CVE-2024-45627 is a medium-severity flaw (CVSS 5.9) affecting linkis. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis < 1
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.9 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 74%) |
| CISA exploited list | No |
| Weakness | CWE-552 |
| Published | 2025-01-14 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-45627?
linkis: upgrade to 1.7.0. Exact commands for each OS are on this page.
Is CVE-2024-45627 being exploited?
CVE-2024-45627 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-45627 affect?
CVE-2024-45627 affects linkis. Severity is medium (CVSS 5.9). In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server
How urgent is CVE-2024-45627?
Priority 32/100. On your watchlist
Software pages
Related CVEs
- CVE-2025-59355 MEDIUM 6.5 UPGRADE A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it
- CVE-2025-29847 HIGH 7.5 UPGRADE A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC e
- CVE-2024-39928 HIGH 7.5 UPGRADE In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated
- CVE-2024-27182 MEDIUM 4.9 UPGRADE In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administr
- CVE-2024-27181 HIGH 8.8 UPGRADE In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a