GitHub Advisoryadvisory · Maven

GHSA-rp6x-ggw6-8g56 Authorization Bypass in Apache InLong

CRITICAL Published 2023-10-16 Modified 2023-11-14 Official page ↗
Aliases
CVE-2023-43668
Ecosystem
Maven
Packages
org.apache.inlong:manager-pojo
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502, CWE-639
Reviewed
2023-10-17

Affected packages

• Maven org.apache.inlong:manager-pojo: >= 1.4.0, < 1.9.0 → fixed in 1.9.0

Description

Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,  some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile".... .   Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1]  https://github.com/apache/inlong/pull/8604

Related

Alias · CVE (1)

  • CVE-2023-43668 Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,… vulnerability

Weakness · CWE (2)

  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References