PT-2023-2846 · Apache · Apache Inlong

CVE-2023-31453 · Publicado 2023-05-22 · Atualizado 2024-10-11

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.2.0 through 1.6.0

Description The issue is related to incorrect permission assignment for critical resources in Apache InLong, allowing a remote attacker to impact the integrity and availability of protected information. Specifically, the attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription.

Recommendations For Apache InLong versions 1.2.0 through 1.6.0, upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7949 to solve the issue. As a temporary workaround, consider restricting access to subscription management features to minimize the risk of exploitation.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

CWE-99

Identificadores relacionados

BDU:2023-02791

CVE-2023-31453

GHSA-8RJH-3MHM-966Q

Produtos afetados

Apache Inlong

Referências · 9

• https://github.com/apache/inlong · Nota
• https://github.com/apache/inlong/pull/7949 · Nota
• https://osv.dev/vulnerability/CVE-2023-31453 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8rjh-3mhm-966q · Aviso do Fabricante
• https://vuldb.com/?id.229649 · Nota
• https://lists.apache.org/thread/9nz8o2skgc5230w276h4w92j0zstnl06 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02791 · Nota de Segurança
• https://t.me/cibsecurity/64533 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31453 · Nota de Segurança