CVE-2023-31453

2023-05-2214:15:09

Google

osv.dev

apache inlong

incorrect permission assignment

critical resource vulnerability

cve-2023-31453

apache software foundation

upgrade

user subscriptions

attacker

AI Score

7.1

Confidence

High

EPSS

0.002

Percentile

61.1%

JSON

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others’ subscriptions, even if they are not the owner
of the deleted subscription. Users are advised to upgrade to Apache InLong’s 1.7.0 or cherry-pick [1] to solve it.

[1]

https://github.com/apache/inlong/pull/7949 https://github.com/apache/inlong/pull/7949