CVE-2023-27987 is a critical vulnerability affecting Apache Linkis versions up to 1.3.1, stemming from a predictable default token generated by the Linkis Gateway. This weakness (CWE-326) allows attackers to easily guess and exploit the token for unauthorized access. With a CVSS score of 9.1, it presents a high risk of complete compromise (confidentiality and integrity) with low attack complexity and no user interaction required. While no public exploits, Metasploit modules, or KEV entries are currently available, and community discussion is minimal, users are strongly advised to upgrade to Linkis 1.3.2 and modify the default token immediately.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.3.1CPE matchmatch criteria | cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.