Lucene search

GitHub Advisory DatabaseGHSA-RP6X-GGW6-8G56

HistoryOct 16, 2023 - 9:30 a.m.

Authorization Bypass in Apache InLong

2023-10-1609:30:19

CWE-502

CWE-639

GitHub Advisory Database

github.com

apache inlong

authorization bypass

user-controlled key

vulnerability

upgrade

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.013

Percentile

85.9%

JSON

Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,

some sensitive params checks will be bypassed, like “autoDeserizalize”,“allowLoadLocalInfile”…

Users are advised to upgrade to Apache InLong’s 1.9.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/8604

Affected configurations

Vulners

Node

org.apache.inlongmanager-pojoRange1.4.0–1.9.0

VendorProductVersionCPE
org.apache.inlongmanager-pojo*cpe:2.3:a:org.apache.inlong:manager-pojo:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.apache.inlong	manager-pojo	*	cpe:2.3:a:org.apache.inlong:manager-pojo::::::::

References

github.com/advisories/GHSA-rp6x-ggw6-8g56

github.com/apache/inlong/commit/46c4e96a84839bd540f47c659c9d8576e393da02

github.com/apache/inlong/pull/8604

lists.apache.org/thread/16gtk7rpdm1rof075ro83fkrnhbzn5sh

nvd.nist.gov/vuln/detail/CVE-2023-43668

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.013

Percentile

85.9%

JSON

Related for GHSA-RP6X-GGW6-8G56