CVE-2022-40955 Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC

2022-09-2013:50:08

CWE-502

apache

www.cve.org

cve-2022-40955

apache inlong

deserialization attack

rce

jdbc

mysql

remote code execution

AI Score

9.2

Confidence

High

EPSS

0.003

Percentile

70.2%

JSON

In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.

CNA Affected

[
  {
    "product": "Apache InLong",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "1.3.0",
        "status": "affected",
        "version": "Apache InLong",
        "versionType": "custom"
      }
    ]
  }
]