github.com
https://github.com/apache/inlong CVE-2023-43668
CRITICAL
Apache InLong: Jdbc Connection Security Bypass in InLong
Record summary
CVE-2023-43668 has a selected CVSS score of 9.8 (critical).
Description
Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile".... . Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8604
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 16, 2024 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
Apache InLongBrowse Apache Software Foundation / Apache InLongDefault status: unaffected | CVE List | 1.4.0 to ≤ 1.8.0 | affected |
inlongBrowse apache / inlongDefault status: unknown | CVE List | 1.4.0 to < 1.8.0 | affected |
org.apache.inlong:manager-pojoBrowse Maven / org.apache.inlong:manager-pojo | GitHub Advisory | 1.4.0 to < 1.9.0 · Fixed in 1.9.0 | affected |
References
5github.com
https://github.com/apache/inlong/commit/46c4e96a84839bd540f47c659c9d8576e393da02 github.com
https://github.com/apache/inlong/pull/8604 lists.apache.orgVendor advisory
https://lists.apache.org/thread/16gtk7rpdm1rof075ro83fkrnhbzn5sh nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-43668