PT-2023-2906 · Apache · Apache Inlong

Charles Zhang · Publicado 2023-05-21 · Atualizado 2024-10-09 · CVE-2023-31454

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.2.0 through 1.6.0

Description The issue is related to an incorrect permission assignment for a critical resource in Apache InLong, allowing a remote attacker to elevate their privileges and bind any cluster, even if they are not the cluster owner.

Recommendations For Apache InLong versions 1.2.0 through 1.6.0, users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick the solution from https://github.com/apache/inlong/pull/7947 to solve the issue.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

BDU:2023-02861

CVE-2023-31454

GHSA-RF76-WHGP-FP56

Produtos afetados

Apache Inlong

Referências · 9

• https://github.com/apache/inlong · Nota
• https://github.com/apache/inlong/pull/7947 · Nota
• https://lists.apache.org/thread/nqt1tr6pbq8q4b033d7sg5gltx5pmjgl · Aviso do Fabricante
• https://t.me/cibsecurity/64540 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-rf76-whgp-fp56 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-31454 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-31454 · Aviso do Fabricante
• https://t.me/cvenotify/97662 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-02861 · Nota de Segurança