Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5egf-pvh8-rfew
Vulnerability ID VCID-5egf-pvh8-rfew
Aliases CVE-2023-41916
GHSA-f22j-9j59-33j4
Summary In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis = 1.4.0 will be affected.  We recommend users upgrade the version of Linkis to version 1.5.0.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-552 Files or Directories Accessible to External Parties
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0031 https://api.first.org/data/v1/epss?cve=CVE-2023-41916
epss 0.0031 https://api.first.org/data/v1/epss?cve=CVE-2023-41916
epss 0.0031 https://api.first.org/data/v1/epss?cve=CVE-2023-41916
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-f22j-9j59-33j4
cvssv3.1 6.5 https://github.com/apache/linkis
cvssv4 7.1 https://github.com/apache/linkis
generic_textual HIGH https://github.com/apache/linkis
cvssv3.1 6.5 https://linkis.apache.org/download/release-notes-1.6.0
cvssv4 7.1 https://linkis.apache.org/download/release-notes-1.6.0
generic_textual HIGH https://linkis.apache.org/download/release-notes-1.6.0
cvssv3.1 6.5 https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729
cvssv4 7.1 https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729
generic_textual HIGH https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729
ssvc Track https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2023-41916
cvssv4 7.1 https://nvd.nist.gov/vuln/detail/CVE-2023-41916
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-41916
cvssv3.1 6.5 http://www.openwall.com/lists/oss-security/2024/07/13/4
cvssv4 7.1 http://www.openwall.com/lists/oss-security/2024/07/13/4
generic_textual HIGH http://www.openwall.com/lists/oss-security/2024/07/13/4
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-41916
https://github.com/apache/linkis
https://linkis.apache.org/download/release-notes-1.6.0
http://www.openwall.com/lists/oss-security/2024/07/13/4
CVE-2023-41916 https://nvd.nist.gov/vuln/detail/CVE-2023-41916
dxkpwyoxy1jpdwlpqp15zvo0jxn4v729 https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729
GHSA-f22j-9j59-33j4 https://github.com/advisories/GHSA-f22j-9j59-33j4
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/apache/linkis
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://github.com/apache/linkis
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://linkis.apache.org/download/release-notes-1.6.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://linkis.apache.org/download/release-notes-1.6.0
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-15T15:17:30Z/ Found at https://lists.apache.org/thread/dxkpwyoxy1jpdwlpqp15zvo0jxn4v729
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-41916
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-41916
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2024/07/13/4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Found at http://www.openwall.com/lists/oss-security/2024/07/13/4
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.54624
EPSS Score 0.0031
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:28:21.017788+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/41xxx/CVE-2023-41916.json 38.6.0