PT-2023-23129 · Apache · Apache Inlong

Lujie.Ac.Cn · Publicado 2023-05-22 · Atualizado 2024-10-09 · CVE-2023-31065

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.6.0

Description The issue is related to insufficient session expiration, allowing an old session to be used by an attacker even after the user has been deleted or the password has been changed.

Recommendations For Apache InLong versions 1.4.0 through 1.6.0, upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 or https://github.com/apache/inlong/pull/7884 to solve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application that rely on session authentication until the issue is resolved.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2023-31065

GHSA-757P-7HP5-PQMR

Produtos afetados

Apache Inlong

Referências · 9

• https://github.com/apache/inlong · Nota
• https://github.com/apache/inlong/pull/7836 · Nota
• https://github.com/apache/inlong/pull/7884 · Nota
• https://t.me/cvenotify/97663 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31065 · Nota de Segurança
• https://t.me/cibsecurity/64558 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-31065 · Aviso do Fabricante
• https://lists.apache.org/thread/to7o0n2cks0omtwo6mhh5cs2vfdbplqf · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-757p-7hp5-pqmr · Aviso do Fabricante