{"id":"CVE-2024-27181","state":"PUBLISHED","title":"Apache Linkis Basic management services: Privilege Escalation Attack vulnerability","description":"In Apache Linkis <= 1.5.0,\n\nPrivilege Escalation in Basic management services where the attacking user is \n\na trusted account\n\n allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.","publishedAt":"2024-08-02T09:27:48.639Z","updatedAt":"2024-08-12T19:53:28.790Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache Linkis Basic management services"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Linkis Basic management services","packageName":"org.apache.linkis:linkis-pes-publicservice","defaultStatus":"unaffected","versions":[{"version":"1.3.2","status":"affected","lessThan":"1.6.0","versionType":"maven"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":["https://lists.apache.org/thread/hosd73l7hxb3rpt5rb0yg0ld11zph4c6","http://www.openwall.com/lists/oss-security/2024/08/02/3"],"weaknesses":["CWE-269"],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/27xxx/CVE-2024-27181.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-27181","state":"PUBLISHED","datePublished":"2024-08-02T09:27:48.639Z","dateUpdated":"2024-08-12T19:53:28.790Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2024-02-21T03:03:36.039Z"},"containers":{"cna":{"title":"Apache Linkis Basic management services: Privilege Escalation Attack vulnerability","descriptions":[{"lang":"en","value":"In Apache Linkis <= 1.5.0,\n\nPrivilege Escalation in Basic management services where the attacking user is \n\na trusted account\n\n allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Linkis Basic management services","packageName":"org.apache.linkis:linkis-pes-publicservice","defaultStatus":"unaffected","versions":[{"version":"1.3.2","status":"affected","lessThan":"1.6.0","versionType":"maven"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":[{"url":"https://lists.apache.org/thread/hosd73l7hxb3rpt5rb0yg0ld11zph4c6","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"important"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2024-08-02T09:27:48.639Z"},"credits":[{"lang":"en","type":"reporter","value":"superx"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"apache","product":"linkis","defaultStatus":"unaffected","versions":[{"version":"1.3.2","status":"affected","lessThan":"1.6.0","versionType":"maven"}],"cpes":["cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-08-02T13:50:17.045234Z","id":"CVE-2024-27181","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-12T19:53:28.790Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2024/08/02/3"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T16:03:23.622Z"}}]}}}