CVE-2023-50740: 
Java vulnerability analysis and mitigation

Apache Linkis version 1.4.0 and earlier contains a security vulnerability where passwords are exposed in log files when using the Oracle data source module. The vulnerability was assigned CVE-2023-50740 and was publicly disclosed on March 6, 2024. This issue affects the DataSource module specifically when interacting with Oracle SQL databases (OSS Security).

The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File). The CVSS v3.1 base score is 5.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, and results in low confidentiality impact without affecting integrity or availability (NVD).

When using the Oracle data source module, database passwords are exposed in log files. This exposure could potentially allow unauthorized users who have access to the logs to obtain database credentials, leading to unauthorized database access (OSS Security).

The vulnerability requires access to the system logs where the passwords are being printed. The issue was reported by security researcher Jonathan Leitschuh (OSS Security).

Users are recommended to upgrade to Apache Linkis version 1.5.0 or later, which contains the fix for this vulnerability (Apache Advisory).