GHSA-757p-7hp5-pqmr CVE-2023-31065
Apache InLong Insufficient Session Expiration vulnerability
- Severity
- 9.1 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 1.16%
- Chance of exploitation in the next 30 days. Higher than 67.23% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-613 Insufficient Session Expiration
- Fix
- Available
- 4 packages have a fixed version
Description
Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.
An old session can be used by an attacker even after the user has been deleted or the password has been changed.
Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 or https://github.com/apache/inlong/pull/7884 to solve it.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.inlong:manager-dao | >= 1.4.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-pojo | >= 1.4.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-service | >= 1.4.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-web | >= 1.4.0, < 1.7.0 |
1.7.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.inlong:manager-dao Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-dao</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-dao:1.7.0")
org.apache.inlong:manager-pojo Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-pojo</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-pojo:1.7.0")
org.apache.inlong:manager-service Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-service</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-service:1.7.0")
org.apache.inlong:manager-web Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-web</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-web:1.7.0")
Severity breakdown
CVSS 3.1 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-613: Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
How to prevent it
- Implementation: Set sessions/credentials expiration date.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-98v7-xxxv-hcrh Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read | Critical | Also affects org.apache.inlong:manager-pojo |
| GHSA-532x-j9r7-8f73 Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass | Medium | Also affects org.apache.inlong:manager-pojo |
| GHSA-r324-vgr5-73c9 Apache InLong: JDBC Vulnerability during verification processing | Medium | Also affects org.apache.inlong:manager-pojo |
| GHSA-fgh3-pwmp-3qw3 Apache Inlong Deserialization of Untrusted Data vulnerability | Critical | Also affects org.apache.inlong:manager-pojo |
| GHSA-crwj-2r3c-gx2g Apache InLong Manager Arbitrary File Read Vulnerability | High | Also affects org.apache.inlong:manager-pojo |
| GHSA-9xg9-hh45-xcm6 Apache InLong Manager Remote Code Execution vulnerability | Critical | Also affects org.apache.inlong:manager-pojo |
| GHSA-jj32-3pf5-5mv5 Apache InLong Deserialization of Untrusted Data Vulnerability | High | Also affects org.apache.inlong:manager-pojo |
| GHSA-rp6x-ggw6-8g56 Authorization Bypass in Apache InLong | Critical | Also affects org.apache.inlong:manager-pojo |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor