PT-2023-5725 · Apache · Apache Inlong

Charles Zhang + 1 · Published 2023-05-22 · Updated 2024-10-11 · CVE-2023-31098

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.1.0 through 1.6.0

Description The issue is related to weak password requirements in Apache InLong. When users change their password to a simple password, attackers can easily guess the user's password and access the account. This allows a remote attacker to gain access to a user's account.

Recommendations To solve the issue, users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7805. As a temporary workaround, consider implementing strong password policies to minimize the risk of exploitation. Restrict access to accounts with simple passwords to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-521

Related Identifiers

BDU:2023-06395

CVE-2023-31098

GHSA-W3WR-GMWF-R333

Affected Products

Apache Inlong

References · 8

• https://osv.dev/vulnerability/CVE-2023-31098 · Vendor Advisory
• https://lists.apache.org/thread/1fvloc3no1gbffzrcsx9ltsg08wr2d1w · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06395 · Security Note
• https://osv.dev/vulnerability/GHSA-w3wr-gmwf-r333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31098 · Security Note
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/pull/7805 · Note
• https://t.me/cibsecurity/64550 · Telegram Post