PT-2023-28912 · Apache · Apache Inlong

Nbxiglk · Published 2023-10-16 · Updated 2023-11-14 · CVE-2023-43668

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.8.0

Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability allows some sensitive parameter checks to be bypassed, including autoDeserizalize and allowLoadLocalInfile.

Recommendations For Apache InLong versions 1.4.0 through 1.8.0, upgrade to Apache InLong's 1.9.0 or cherry-pick the provided patch to solve the issue.

Fix

Deserialization of Untrusted Data

IDOR

Weakness Enumeration

CWE-502

CWE-639

Related Identifiers

CVE-2023-43668

GHSA-RP6X-GGW6-8G56

Affected Products

Apache Inlong

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-43668 · Security Note
• https://lists.apache.org/thread/16gtk7rpdm1rof075ro83fkrnhbzn5sh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-43668 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rp6x-ggw6-8g56 · Vendor Advisory
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/commit/46c4e96a84839bd540f47c659c9d8576e393da02 · Note
• https://github.com/apache/inlong/pull/8604 · Note