CVE-2022-44645

CVE-2022-44645: Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability

Vendor Apache Software Foundation

Product Apache Linkis (incubating)

Weakness CWE-502 · Unsafe deserialization

Published January 31, 2023

Last update March 27, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users to upgrade the version of Linkis to version 1.3.1.

Key dates

02Disclosure timeline

January 31, 2023 CVE published

March 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-44645 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html AskarLabs — CWE-502 write-up Deserialization of Untrusted Data

Related vulnerabilities

04Related CVE

CVE-2026-15962 Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field CVE-2026-65575 WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability CVE-2026-57724 WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability CVE-2026-65549 WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability CVE-2026-65552 WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability