CVE-2023-50740 - Vulnerability Details - OpenCVE

ReportizFlow

In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/03/06/2
https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo

History

Fri, 08 Nov 2024 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2024-03-06T13:44:53.867Z

Updated: 2024-11-08T21:23:53.249Z

Reserved: 2023-12-12T07:23:41.114Z

Link: CVE-2023-50740

Vulnrichment

Updated: 2024-08-02T22:16:47.264Z

NVD

Status : Awaiting Analysis

Published: 2024-03-06T14:15:47.407

Modified: 2024-11-21T08:37:14.957

Link: CVE-2023-50740

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-50740", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2023-12-12T07:23:41.114Z", "datePublished": "2024-03-06T13:44:53.867Z", "dateUpdated": "2024-11-08T21:23:53.249Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.linkis:linkis-metadata-query-service-jdbc", "product": "Apache Linkis DataSource", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.5.0", "status": "affected", "version": "*", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jonathan Leitschuh"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. <br>We recommend users upgrade the version of Linkis to version 1.5.0<br>"}], "value": "In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module.\u00a0\nWe recommend users upgrade the version of Linkis to version 1.5.0\n"}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-03-06T13:44:53.867Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo"}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/06/2"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-09T20:29:21.854412Z", "id": "CVE-2023-50740", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-08T21:23:53.249Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:47.264Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo"}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/06/2", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/06/2", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:47.264Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-50740", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-09T20:29:21.854412Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-09T20:29:29.487Z"}}], "cna": {"title": "Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Jonathan Leitschuh"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Linkis DataSource", "versions": [{"status": "affected", "version": "*", "lessThan": "1.5.0", "versionType": "maven"}], "packageName": "org.apache.linkis:linkis-metadata-query-service-jdbc", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/06/2"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module.\u00a0\nWe recommend users upgrade the version of Linkis to version 1.5.0\n", "supportingMedia": [{"type": "text/html", "value": "In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. <br>We recommend users upgrade the version of Linkis to version 1.5.0<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-03-06T13:44:53.867Z"}}}, "cveMetadata": {"cveId": "CVE-2023-50740", "state": "PUBLISHED", "dateUpdated": "2024-11-08T21:23:53.249Z", "dateReserved": "2023-12-12T07:23:41.114Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-03-06T13:44:53.867Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}