PT-2023-28911 · Apache · Apache Inlong

Jayway · Published 2023-10-16 · Updated 2025-06-16 · CVE-2023-43667

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.8.0

Description The issue affects Apache InLong, allowing an attacker to create misleading or false log records. This makes it harder to audit and trace malicious activities. The estimated number of potentially affected devices is not provided.

Recommendations To solve the issue, users are advised to upgrade to Apache InLong's 1.9.0. As a temporary workaround, consider restricting access to log records until a patch is available. For versions prior to 1.9.0, cherry-pick https://github.com/apache/inlong/pull/8628 to solve the issue.

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2023-43667

GHSA-FPCF-QR79-HJQP

Affected Products

Apache Inlong

References · 8

• https://lists.apache.org/thread/spnb378g268p1f902fr9kqyph2k8n543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43667 · Security Note
• https://osv.dev/vulnerability/GHSA-fpcf-qr79-hjqp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43667 · Vendor Advisory
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/pull/8628 · Note
• https://t.me/cvenotify/96302 · Telegram Post
• https://t.me/cvenotify/125818 · Telegram Post