GitHub Advisoryadvisory · Maven

GHSA-r5pv-7g89-cxmc SQL injection in audit endpoint

CRITICAL Published 2023-07-25 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-35088
Ecosystem
Maven
Packages
org.apache.inlong:manager-service
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2023-07-25

Affected packages

• Maven org.apache.inlong:manager-service: >= 1.4.0, < 1.8.0 → fixed in 1.8.0

Description

Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.  In the toAuditCkSql method, the groupId, streamId, auditId, and dt are directly concatenated into the SQL query statement, which may lead to SQL injection attacks. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8198

Related

Alias · CVE (1)

  • CVE-2023-35088 Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References