Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-qjn8-9ben-wuef
Vulnerability ID VCID-qjn8-9ben-wuef
Aliases CVE-2023-49566
GHSA-7qpc-4xx9-x5qw
Summary In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted.  This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-502 Deserialization of Untrusted Data
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00708 https://api.first.org/data/v1/epss?cve=CVE-2023-49566
epss 0.00708 https://api.first.org/data/v1/epss?cve=CVE-2023-49566
epss 0.00708 https://api.first.org/data/v1/epss?cve=CVE-2023-49566
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-7qpc-4xx9-x5qw
cvssv3.1 8.8 https://github.com/apache/linkis
cvssv4 8.7 https://github.com/apache/linkis
generic_textual HIGH https://github.com/apache/linkis
cvssv3.1 8.8 https://linkis.apache.org/download/release-notes-1.6.0
cvssv4 8.7 https://linkis.apache.org/download/release-notes-1.6.0
generic_textual HIGH https://linkis.apache.org/download/release-notes-1.6.0
cvssv3.1 8.8 https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj
cvssv4 8.7 https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj
generic_textual HIGH https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj
ssvc Track https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2023-49566
cvssv4 8.7 https://nvd.nist.gov/vuln/detail/CVE-2023-49566
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-49566
cvssv3.1 8.8 http://www.openwall.com/lists/oss-security/2024/07/13/5
cvssv4 8.7 http://www.openwall.com/lists/oss-security/2024/07/13/5
generic_textual HIGH http://www.openwall.com/lists/oss-security/2024/07/13/5
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-49566
https://github.com/apache/linkis
https://linkis.apache.org/download/release-notes-1.6.0
http://www.openwall.com/lists/oss-security/2024/07/13/5
CVE-2023-49566 https://nvd.nist.gov/vuln/detail/CVE-2023-49566
GHSA-7qpc-4xx9-x5qw https://github.com/advisories/GHSA-7qpc-4xx9-x5qw
t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/linkis
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://github.com/apache/linkis
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://linkis.apache.org/download/release-notes-1.6.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://linkis.apache.org/download/release-notes-1.6.0
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-15T13:14:11Z/ Found at https://lists.apache.org/thread/t68yy52lmv7pxgrxnq6rw7rwvk9tb1xj
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-49566
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-49566
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2024/07/13/5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Found at http://www.openwall.com/lists/oss-security/2024/07/13/5
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.72655
EPSS Score 0.00708
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:21:32.324995+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/49xxx/CVE-2023-49566.json 38.6.0