GitHub Advisoryadvisory · Maven

GHSA-rf76-whgp-fp56 Apache InLong vulnerable to Incorrect Permission Assignment for Critical Resource

HIGH Published 2023-07-06 Modified 2023-07-06 Official page ↗
Aliases
CVE-2023-31454
Ecosystem
Maven
Packages
org.apache.inlong:manager-service
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-732
Reviewed
2023-07-06

Affected packages

• Maven org.apache.inlong:manager-service: >= 1.2.0, < 1.7.0 → fixed in 1.7.0

Description

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade to Apache InLong 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7947 to solve it.

Related

Alias · CVE (1)

  • CVE-2023-31454 Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References