PT-2023-2906 · Apache · Apache Inlong

Charles Zhang · Published 2023-05-21 · Updated 2024-10-09 · CVE-2023-31454

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.2.0 through 1.6.0

Description The issue is related to an incorrect permission assignment for a critical resource in Apache InLong, allowing a remote attacker to elevate their privileges and bind any cluster, even if they are not the cluster owner.

Recommendations For Apache InLong versions 1.2.0 through 1.6.0, users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick the solution from https://github.com/apache/inlong/pull/7947 to solve the issue.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2023-02861

CVE-2023-31454

GHSA-RF76-WHGP-FP56

Affected Products

Apache Inlong

References · 9

• https://lists.apache.org/thread/nqt1tr6pbq8q4b033d7sg5gltx5pmjgl · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rf76-whgp-fp56 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31454 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31454 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02861 · Security Note
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/pull/7947 · Note
• https://t.me/cibsecurity/64540 · Telegram Post
• https://t.me/cvenotify/97662 · Telegram Post