CVE-2023-29216

CVE-2023-29216: Apache Linkis DatasourceManager module has a deserialization command execution

Vendor Apache Software Foundation

Product Apache Linkis

Weakness CWE-502 · Unsafe deserialization

Published April 10, 2023

Last update February 13, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a new data source to trigger a deserialization vulnerability, eventually leading to remote code execution. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.2.

Key dates

02Disclosure timeline

April 10, 2023 CVE published

February 13, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-29216 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html AskarLabs — CWE-502 write-up Deserialization of Untrusted Data

Related vulnerabilities

04Related CVE

CVE-2026-78286 WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability CVE-2026-12240 Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field CVE-2026-32470 WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability CVE-2026-65549 WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability CVE-2026-65556 WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability