CVE-2024-36268 Apache InLong TubeMQ Client: Remote Code Execution vulnerability

2024-08-0209:44:26

CWE-94

apache

www.cve.org

cve-2024-36268

apache inlong

remote code execution

code injection

upgrade

apache inlong 1.13.0

EPSS

0.01

Percentile

83.6%

JSON

Improper Control of Generation of Code (‘Code Injection’) vulnerability in Apache InLong.

This issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong’s 1.13.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/10251

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.inlong:tubemq-client",
    "product": "Apache InLong TubeMQ Client",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.12.0",
        "status": "affected",
        "version": "1.10.0",
        "versionType": "semver"
      }
    ]
  }
]

References

lists.apache.org/thread/1w1yp1bg5sjvn46dszkf00tz1vfs0frc

EPSS

0.01

Percentile

83.6%

JSON

Related for CVELIST:CVE-2024-36268