PT-2023-9156 · Apache · Apache Inlong

X1R0Z · Publicado 2023-11-23 · Atualizado 2025-05-16 · CVE-2023-51784

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.5.0 through 1.9.0

Description The issue is related to an Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong, which could lead to Remote Code Execution. This vulnerability affects Apache InLong versions from 1.5.0 through 1.9.0.

Recommendations To solve the issue, users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick the solution provided in https://github.com/apache/inlong/pull/9329.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2024-04253

CVE-2023-51784

GHSA-9XG9-HH45-XCM6

Produtos afetados

Apache Inlong

Referências · 20

• https://github.com/apache/inlong · Nota
• https://github.com/apache/inlong/commit/1607837be28438c0ccae8da15afb653f2afed090 · Nota
• https://github.com/apache/inlong/pull/9329 · Nota
• https://github.com/apache/inlong/issues/9328 · Nota
• https://github.com/y1ong/blog-timeline/issues/349 · Nota
• https://github.com/foyaga/blog-timeline/issues/62 · Nota
• https://osv.dev/vulnerability/GHSA-9xg9-hh45-xcm6 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-51784 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1742484072973181050 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2024/01/03/1 · Nota
• https://t.me/cibsecurity/74313 · Publicação no Telegram
• https://lists.apache.org/thread/4nxbyl6mh5jgh0plk0qposbxwn6w9h8j · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-51784 · Nota de Segurança
• https://t.me/cvenotify/66813 · Publicação no Telegram
• https://t.me/cvenotify/66057 · Publicação no Telegram