PT-2023-9156 · Apache · Apache Inlong

X1R0Z · Published 2023-11-23 · Updated 2025-05-16 · CVE-2023-51784

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.5.0 through 1.9.0

Description The issue is related to an Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong, which could lead to Remote Code Execution. This vulnerability affects Apache InLong versions from 1.5.0 through 1.9.0.

Recommendations To solve the issue, users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick the solution provided in https://github.com/apache/inlong/pull/9329.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-04253

CVE-2023-51784

GHSA-9XG9-HH45-XCM6

Affected Products

Apache Inlong

References · 20

• https://osv.dev/vulnerability/GHSA-9xg9-hh45-xcm6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-51784 · Vendor Advisory
• https://lists.apache.org/thread/4nxbyl6mh5jgh0plk0qposbxwn6w9h8j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51784 · Security Note
• https://bdu.fstec.ru/vul/2024-04253 · Security Note
• https://github.com/apache/inlong · Note
• https://github.com/apache/inlong/commit/1607837be28438c0ccae8da15afb653f2afed090 · Note
• https://github.com/apache/inlong/pull/9329 · Note
• https://github.com/apache/inlong/issues/9328 · Note
• https://github.com/y1ong/blog-timeline/issues/349 · Note
• https://github.com/foyaga/blog-timeline/issues/62 · Note
• https://twitter.com/CVEnew/status/1742484072973181050 · Twitter Post
• http://openwall.com/lists/oss-security/2024/01/03/1 · Note
• https://t.me/cibsecurity/74313 · Telegram Post
• https://t.me/cvenotify/66813 · Telegram Post