GitHub Advisoryadvisory · Maven

GHSA-8rjh-3mhm-966q Apache InLong Incorrect Permission Assignment for Critical Resource Vulnerability

HIGH Published 2023-07-06 Modified 2023-07-06 Official page ↗
Aliases
CVE-2023-31453
Ecosystem
Maven
Packages
org.apache.inlong:manager-service, org.apache.inlong:manager-web
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-732
Reviewed
2023-07-06

Affected packages

• Maven org.apache.inlong:manager-service: >= 1.2.0, < 1.7.0 → fixed in 1.7.0 • Maven org.apache.inlong:manager-web: >= 1.2.0, < 1.7.0 → fixed in 1.7.0

Description

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7949 to solve it.

Related

Alias · CVE (1)

  • CVE-2023-31453 Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References