CVE-2023-50740 - Vulnerability Details - OpenCVE

In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Apache	Linkis

Configuration 1 [-]

cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/03/06/2
https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo

History

Wed, 07 May 2025 16:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apache Apache linkis
CPEs		cpe:2.3:a:apache:linkis::::::::
Vendors & Products		Apache Apache linkis

Thu, 13 Feb 2025 17:30:00 +0000

Type	Values Removed	Values Added
Description	In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0	In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0

Fri, 08 Nov 2024 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2024-03-06T13:44:53.867Z

Updated: 2025-02-13T17:19:29.492Z

Reserved: 2023-12-12T07:23:41.114Z

Link: CVE-2023-50740

Vulnrichment

Updated: 2024-08-02T22:16:47.264Z

NVD

Status : Analyzed

Published: 2024-03-06T14:15:47.407

Modified: 2025-05-07T15:46:18.713

Link: CVE-2023-50740

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-50740", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2023-12-12T07:23:41.114Z", "datePublished": "2024-03-06T13:44:53.867Z", "dateUpdated": "2025-02-13T17:19:29.492Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.linkis:linkis-metadata-query-service-jdbc", "product": "Apache Linkis DataSource", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.5.0", "status": "affected", "version": "*", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Jonathan Leitschuh"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. <br>We recommend users upgrade the version of Linkis to version 1.5.0<br>"}], "value": "In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module.\u00a0\nWe recommend users upgrade the version of Linkis to version 1.5.0"}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-05-01T18:07:00.107Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo"}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/06/2"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-09T20:29:21.854412Z", "id": "CVE-2023-50740", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-08T21:23:53.249Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:47.264Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo"}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/06/2", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/06/2", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:47.264Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-50740", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-09T20:29:21.854412Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-09T20:29:29.487Z"}}], "cna": {"title": "Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Jonathan Leitschuh"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Linkis DataSource", "versions": [{"status": "affected", "version": "*", "lessThan": "1.5.0", "versionType": "maven"}], "packageName": "org.apache.linkis:linkis-metadata-query-service-jdbc", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/06/2"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module.\u00a0\nWe recommend users upgrade the version of Linkis to version 1.5.0", "supportingMedia": [{"type": "text/html", "value": "In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. <br>We recommend users upgrade the version of Linkis to version 1.5.0<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-05-01T18:07:00.107Z"}}}, "cveMetadata": {"cveId": "CVE-2023-50740", "state": "PUBLISHED", "dateUpdated": "2025-02-13T17:19:29.492Z", "dateReserved": "2023-12-12T07:23:41.114Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-03-06T13:44:53.867Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}