PT-2023-28912 · Apache · Apache Inlong

Nbxiglk · Publicado 2023-10-16 · Atualizado 2023-11-14 · CVE-2023-43668

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.8.0

Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability allows some sensitive parameter checks to be bypassed, including autoDeserizalize and allowLoadLocalInfile.

Recommendations For Apache InLong versions 1.4.0 through 1.8.0, upgrade to Apache InLong's 1.9.0 or cherry-pick the provided patch to solve the issue.

Correção

Deserialization of Untrusted Data

IDOR

Enumeração de Fraquezas

CWE-502

CWE-639

Identificadores relacionados

CVE-2023-43668

GHSA-RP6X-GGW6-8G56

Produtos afetados

Apache Inlong

Referências · 7

• https://github.com/apache/inlong · Nota
• https://github.com/apache/inlong/commit/46c4e96a84839bd540f47c659c9d8576e393da02 · Nota
• https://github.com/apache/inlong/pull/8604 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-43668 · Nota de Segurança
• https://lists.apache.org/thread/16gtk7rpdm1rof075ro83fkrnhbzn5sh · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-43668 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rp6x-ggw6-8g56 · Aviso do Fabricante