{"id":"CVE-2024-27181","aliases":["EUVD-2024-2655","GHSA-v352-rg37-5q5m"],"status":"published","title":"Apache Linkis Basic management services: Privilege Escalation Attack vulnerability","description":"In Apache Linkis \u003c= 1.5.0,\n\nPrivilege Escalation in Basic management services where the attacking user is \n\na trusted account\n\n allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00644,"percentile":0.51252,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2024-08-02T09:27:48Z","modified":"2026-11-08T10:45:10Z","fixes":[{"ecosystem":"Maven","package":"org.apache.linkis:linkis","fixed_in":["1.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.linkis:linkis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.linkis:linkis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}],"versions":["1.0.3","1.1.0","1.1.1","1.1.2","1.1.3","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.5.0"]}],"products":[{"vendor":"apache","product":"linkis"},{"vendor":"apache software foundation","product":"apache linkis basic management services"}],"references":[{"url":"https://lists.apache.org/thread/hosd73l7hxb3rpt5rb0yg0ld11zph4c6","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/08/02/3","tags":["Mailing List","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27181","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2024/08/02/3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v352-rg37-5q5m"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27181.json","tags":["advisory"]},{"url":"https://github.com/apache/linkis","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-27181","title":"Apache Linkis Basic management services: Privilege Escalation Attack vulnerability","description":"In Apache Linkis \u003c= 1.5.0,\n\nPrivilege Escalation in Basic management services where the attacking user is \n\na trusted account\n\n allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.","status":"published","published":"2024-08-02T09:27:48.639Z","modified":"2024-08-12T19:53:28.79Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:34:12.982241Z"}],"euvd":[{"id":"EUVD-2024-2655","description":"In Apache Linkis \u003c= 1.5.0,\n\nPrivilege Escalation in Basic management services where the attacking user is \n\na trusted account\n\n allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.","status":"published","published":"2024-08-02T09:27:48Z","modified":"2024-08-12T19:53:28Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:19.748102Z"}],"ghsa":[{"id":"GHSA-v352-rg37-5q5m","title":"Apache Linkis vulnerable to privilege escalation","description":"In Apache Linkis \u003c= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.","status":"published","published":"2024-08-02T12:31:43Z","modified":"2025-06-04T21:14:20Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:38:45.948817Z"}],"nvd":[{"id":"CVE-2024-27181","description":"In Apache Linkis \u003c= 1.5.0,\n\nPrivilege Escalation in Basic management services where the attacking user is \n\na trusted account\n\n allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.","status":"published","published":"2024-08-02T10:15:59.99Z","modified":"2026-06-17T07:19:22.86Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:10:15.933769Z"}],"osv":[{"id":"CVE-2024-27181","title":"Apache Linkis Basic management services: Privilege Escalation Attack vulnerability","description":"In Apache Linkis \u003c= 1.5.0,\n\nPrivilege Escalation in Basic management services where the attacking user is \n\na trusted account\n\n allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.","status":"published","published":"2024-08-02T09:27:48.639Z","modified":"2026-11-08T13:15:01.920795288Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-08T11:04:08.386699Z"},{"id":"GHSA-v352-rg37-5q5m","title":"Apache Linkis vulnerable to privilege escalation","description":"In Apache Linkis \u003c= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.","status":"published","published":"2024-08-02T12:31:43Z","modified":"2025-06-04T21:29:49.20098Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:56.639206Z"}]}}