PT-2023-24727 · Apache · Apache Inlong

Charles Zhang · Publicado 2023-07-25 · Atualizado 2023-08-02 · CVE-2023-34189

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.7.0

Description The issue allows an attacker to use general users to delete and update processes that should only be operable by admins.

Recommendations For versions 1.4.0 through 1.7.0, upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8109 to solve the issue.

Correção

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-668

Identificadores relacionados

CVE-2023-34189

GHSA-86PW-4RQP-6X7V

Produtos afetados

Apache Inlong

Referências · 9

• https://github.com/apache/inlong · Nota
• https://github.com/apache/inlong/issues/8108 · Nota
• https://github.com/apache/inlong/pull/8109 · Nota
• http://openwall.com/lists/oss-security/2023/07/25/2 · Nota
• https://lists.apache.org/thread/smxqyx43hxjvzv4w71n2n3rfho9p378s · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-34189 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-86pw-4rqp-6x7v · Aviso do Fabricante
• https://t.me/cibsecurity/67212 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-34189 · Aviso do Fabricante