PT-2023-24727 · Apache · Apache Inlong

Charles Zhang · Published 2023-07-25 · Updated 2023-08-02 · CVE-2023-34189

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.7.0

Description The issue allows an attacker to use general users to delete and update processes that should only be operable by admins.

Recommendations For versions 1.4.0 through 1.7.0, upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8109 to solve the issue.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2023-34189

GHSA-86PW-4RQP-6X7V

Affected Products

Apache Inlong

References · 9

• https://lists.apache.org/thread/smxqyx43hxjvzv4w71n2n3rfho9p378s · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34189 · Security Note
• https://osv.dev/vulnerability/GHSA-86pw-4rqp-6x7v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34189 · Vendor Advisory
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/issues/8108 · Note
• https://github.com/apache/inlong/pull/8109 · Note
• http://openwall.com/lists/oss-security/2023/07/25/2 · Note
• https://t.me/cibsecurity/67212 · Telegram Post