GitHub Advisoryadvisory · Maven

GHSA-cqr6-3x3f-9wr3 Apache InLong SQL Injection vulnerability

MEDIUM Published 2023-07-06 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-30465
Ecosystem
Maven
Packages
org.apache.inlong:manager-pojo, org.apache.inlong:manager-service
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-89
Reviewed
2023-07-06

Affected packages

• Maven org.apache.inlong:manager-pojo: >= 1.4.0, < 1.6.0 → fixed in 1.6.0 • Maven org.apache.inlong:manager-service: >= 1.4.0, < 1.6.0 → fixed in 1.6.0

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.5.0. By manipulating the "orderType" parameter and the ordering of the returned content using an SQL injection attack, an attacker can extract the username of the   user with ID 1 from the "user" table, one character at a time.  Users are advised to upgrade to Apache InLong's 1.6.0 or cherry-pick PR #7530 to solve it.

Related

Alias · CVE (1)

  • CVE-2023-30465 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References