PT-2023-2846 · Apache · Apache Inlong

Published 2023-05-22 · Updated 2024-10-11 · CVE-2023-31453

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.2.0 through 1.6.0

Description The issue is related to incorrect permission assignment for critical resources in Apache InLong, allowing a remote attacker to impact the integrity and availability of protected information. Specifically, the attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription.

Recommendations For Apache InLong versions 1.2.0 through 1.6.0, upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7949 to solve the issue. As a temporary workaround, consider restricting access to subscription management features to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-99

Related Identifiers

BDU:2023-02791

CVE-2023-31453

GHSA-8RJH-3MHM-966Q

Affected Products

Apache Inlong

References · 9

• https://osv.dev/vulnerability/CVE-2023-31453 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8rjh-3mhm-966q · Vendor Advisory
• https://lists.apache.org/thread/9nz8o2skgc5230w276h4w92j0zstnl06 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02791 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-31453 · Security Note
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/pull/7949 · Note
• https://vuldb.com/?id.229649 · Note
• https://t.me/cibsecurity/64533 · Telegram Post