Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/55514?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55514?format=api", "vulnerability_id": "VCID-xnjd-81cr-ykfz", "summary": "Apache Linkis DataSource allows arbitrary file reading\nIn Apache Linkis = 1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be denylisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out.\n\nVersions of Apache Linkis = 1.4.0 will be affected.\n\nWe recommend users upgrade the version of Linkis to version 1.6.0.", "aliases": [ { "alias": "CVE-2023-41916" }, { "alias": "GHSA-f22j-9j59-33j4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/82179?format=api", "purl": "pkg:maven/org.apache.linkis/linkis-datasource@1.6.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.linkis/linkis-datasource@1.6.0" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/82180?format=api", "purl": "pkg:maven/org.apache.linkis/linkis-datasource@1.4.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-s256-d5bj-q7h4" }, { "vulnerability": "VCID-svpv-ns6w-1kbj" }, { "vulnerability": "VCID-xnjd-81cr-ykfz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.linkis/linkis-datasource@1.4.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/751374?format=api", "purl": "pkg:maven/org.apache.linkis/linkis-datasource@1.5.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-s256-d5bj-q7h4" }, { "vulnerability": "VCID-svpv-ns6w-1kbj" }, { "vulnerability": "VCID-xnjd-81cr-ykfz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.linkis/linkis-datasource@1.5.0" } ], "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2023-41916", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0031", "scoring_system": "epss", "scoring_elements": "0.54563", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.0031", "scoring_system": "epss", "scoring_elements": "0.54532", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.0031", "scoring_system": "epss", "scoring_elements": "0.54554", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.0031", "scoring_system": "epss", "scoring_elements": "0.54553", "published_at": "2026-06-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2023-41916" }, { "reference_url": "https://github.com/apache/linkis", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/linkis" }, { "reference_url": "https://linkis.apache.org/download/release-notes-1.6.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://linkis.apache.org/download/release-notes-1.6.0" }, { "reference_url": "https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-15T15:17:30Z/" } ], "url": "https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2024/07/13/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2024/07/13/4" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41916", "reference_id": "CVE-2023-41916", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41916" }, { "reference_url": "https://github.com/advisories/GHSA-f22j-9j59-33j4", "reference_id": "GHSA-f22j-9j59-33j4", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-f22j-9j59-33j4" } ], "weaknesses": [ { "cwe_id": 552, "name": "Files or Directories Accessible to External Parties", "description": "The product makes files or directories accessible to unauthorized actors, even though they should not be." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." } ], "exploits": [], "severity_range_score": "6.5 - 8.9", "exploitability": "0.5", "weighted_severity": "8.0", "risk_score": 4.0, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xnjd-81cr-ykfz" }