GitHub Advisoryadvisory · Maven

GHSA-86pw-4rqp-6x7v Apache InLong: General user can delete and update process

MEDIUM Published 2023-07-25 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-34189
Ecosystem
Maven
Packages
org.apache.inlong:inlong-manager
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-668
Reviewed
2023-07-25

Affected packages

• Maven org.apache.inlong:inlong-manager: >= 1.4.0, < 1.8.0 → fixed in 1.8.0

Description

Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could use general users to delete and update the process, which only the admin can operate occurrences.  Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8109  to solve it.

Related

Alias · CVE (1)

  • CVE-2023-34189 Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0… vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References