CVE-2022-44644: Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-31 · updated 2026-06-17
Weakness: CWE-20

Description

In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, the parameters in the JDBC URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.1

Affected products

Apache Software Foundation Apache Linkis: through 1.3.0

References

https://lists.apache.org/thread/hwq9ytq6y1kdh9lz5znptkcrdll9x85h
https://lists.apache.org/thread/hwq9ytq6y1kdh9lz5znptkcrdll9x85h

Get alerted when CVE-2022-44644 or the next vulnerability affects your stack