CVE-2024-27182
Apache Linkis File Deletion Remote Code Execution (RCE)
Description
In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any file accessible by the Linkis system user . Users are recommended to upgrade to version 1.6.0, which fixes this issue.
INFO
Published Date :
Aug. 2, 2024, 10:16 a.m.
Last Modified :
Aug. 16, 2024, 4:55 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
3.6
Exploitability Score :
1.2
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-27182.
| URL | Resource |
|---|---|
| https://lists.apache.org/thread/2of1p433h8rbq2bx525rtftnk19oz38h | Mailing List Vendor Advisory |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-27182 vulnerability anywhere in the article.
-
Cybersecurity News
North Korea Targets DeFi and Crypto Companies with Advanced Social Engineering Attacks
Please enable JavaScriptThe FBI has warned sternly about North Korean state-sponsored hackers employing highly sophisticated social engineering tactics to infiltrate decentralized finance (DeFi) and c ... Read more
-
Cybersecurity News
CVE-2024-38106: 0-Day Windows Kernel Vulnerability Exploited in the Wild, PoC Published
Recently, security researcher Sergey Kornienko from PixiePoint Security published an analysis and proof-of-concept (PoC) exploit for a critical zero-day vulnerability in the Windows Kernel, identified ... Read more
-
Cybersecurity News
Researcher Identifies ToddyCat-Inspired APT Attack Leveraging ICMP Backdoor and Microsoft Exchange Flaws
Image: KasperskyCybersecurity researchers at Kaspersky’s Global Emergency Response Team (GERT) have uncovered a sophisticated attack involving an ICMP backdoor, bearing striking similarities to the ta ... Read more
-
Cybersecurity News
Proof-of-Concept Exploit Released for WhatsUp Gold Authentication Bypass (CVE-2024-6670)
Researcher Sina Kheirkhah of the Summoning Team has published the technical details and a proof-of-concept (PoC) exploit for a critical vulnerability, identified as CVE-2024-6670, affecting Progress S ... Read more
-
Cybersecurity News
Google TAG Uncovers Watering Hole Attacks on Mongolian Government Websites
In a revealing report, Google’s Threat Analysis Group (TAG) has uncovered a series of sophisticated watering hole attacks targeting Mongolian government websites between November 2023 and July 2024. T ... Read more
-
Cybersecurity News
Critical Flaw Discovered in Popular Python Library Pandas
Information Stealer Malware on the Rise: ACSC Issues Urgent Cybersecurity WarningThe Australian Cyber Security Centre (ACSC) has issued a warning about the escalating threat of information stealer mal ... Read more
-
Cybersecurity News
CVE-2024-5651: RCE Vulnerability in Fence Agents Exposes Critical Infrastructure to Exploitation
A high-severity security vulnerability (CVE-2024-5651, CVSS 8.8) has been discovered in fence agents, a vital component of many enterprise storage environments. This flaw could enable remote code exec ... Read more
-
Cybersecurity News
CVE-2024-7589: OpenSSH Pre-Authentication Vulnerability in FreeBSD Exposes Systems to RCE
Please enable JavaScriptIn a recent security advisory, the FreeBSD Project disclosed a critical vulnerability (CVE-2024-7589) in OpenSSH, the widely-used implementation of the SSH protocol suite. This ... Read more
-
Cybersecurity News
PoC Exploit Releases for Cisco SSM On-Prem Account Takeover (CVE-2024-20419) Flaw
Image Credit: Mohammed AdelA critical vulnerability, identified as CVE-2024-20419, has been publicly disclosed by security researcher Mohammed Adel, who published a detailed writeup along with proof-o ... Read more
-
Cybersecurity News
CVE-2024-38200: Zero-Day Vulnerability in Microsoft Office: A Call for Urgent Action
In a recent advisory published on August 8th, Microsoft disclosed a high-severity zero-day vulnerability affecting multiple versions of its Office software suite. The vulnerability tracked as CVE-2024 ... Read more
The following table lists the changes that have been made to the
CVE-2024-27182 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Aug. 16, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N Changed Reference Type https://lists.apache.org/thread/2of1p433h8rbq2bx525rtftnk19oz38h No Types Assigned https://lists.apache.org/thread/2of1p433h8rbq2bx525rtftnk19oz38h Mailing List, Vendor Advisory Added CWE NIST CWE-552 Added CPE Configuration OR *cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:* versions from (including) 1.3.2 up to (excluding) 1.6.0 -
CVE Received by [email protected]
Aug. 02, 2024
Action Type Old Value New Value Added Description In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any file accessible by the Linkis system user . Users are recommended to upgrade to version 1.6.0, which fixes this issue. Added Reference Apache Software Foundation https://lists.apache.org/thread/2of1p433h8rbq2bx525rtftnk19oz38h [No types assigned] Added CWE Apache Software Foundation CWE-552
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-27182 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-27182
weaknesses.