GitHub Advisoryadvisory · Maven

GHSA-h79m-5cm2-278c User data exposure in Apache InLong

MEDIUM Published 2023-05-22 Modified 2023-05-30 Official page ↗
Aliases
CVE-2023-31101
Ecosystem
Maven
Packages
org.apache.inlong:manager-dao, org.apache.inlong:manager-pojo, org.apache.inlong:manager-service, org.apache.inlong:manager-web
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-1188
Reviewed
2023-05-22

Affected packages

• Maven org.apache.inlong:manager-dao: >= 1.5.0, < 1.7.0 → fixed in 1.7.0 • Maven org.apache.inlong:manager-pojo: >= 1.5.0, < 1.7.0 → fixed in 1.7.0 • Maven org.apache.inlong:manager-service: >= 1.5.0, < 1.7.0 → fixed in 1.7.0 • Maven org.apache.inlong:manager-web: >= 1.5.0, < 1.7.0 → fixed in 1.7.0

Description

Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0. Users registered in InLong who joined later can see deleted users' data. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 to solve it.

Related

Alias · CVE (1)

  • CVE-2023-31101 Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong:… vulnerability

Weakness · CWE (1)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness

References