PT-2023-5725 · Apache · Apache Inlong

Charles Zhang + 1 · Publicado 2023-05-22 · Atualizado 2024-10-11 · CVE-2023-31098

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.1.0 through 1.6.0

Description The issue is related to weak password requirements in Apache InLong. When users change their password to a simple password, attackers can easily guess the user's password and access the account. This allows a remote attacker to gain access to a user's account.

Recommendations To solve the issue, users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7805. As a temporary workaround, consider implementing strong password policies to minimize the risk of exploitation. Restrict access to accounts with simple passwords to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-521

Identificadores relacionados

BDU:2023-06395

CVE-2023-31098

GHSA-W3WR-GMWF-R333

Produtos afetados

Apache Inlong

Referências · 8

• https://github.com/apache/inlong · Nota
• https://github.com/apache/inlong/pull/7805 · Nota
• https://osv.dev/vulnerability/CVE-2023-31098 · Aviso do Fabricante
• https://t.me/cibsecurity/64550 · Publicação no Telegram
• https://lists.apache.org/thread/1fvloc3no1gbffzrcsx9ltsg08wr2d1w · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-06395 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-w3wr-gmwf-r333 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-31098 · Nota de Segurança