GHSA-f475-jgg3-3jwc CVE-2023-31206
Apache InLong Exposure of Resource to Wrong Sphere vulnerability
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.25%
- Chance of exploitation in the next 30 days. Higher than 69.34% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-668 Exposure of Resource to Wrong Sphere
- Fix
- Available
- 5 packages have a fixed version
Description
Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of nodes of InLong. Users are advised to upgrade to Apache InLong 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7891 to solve it.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.inlong:manager-dao | >= 1.4.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-pojo | >= 1.4.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-service | >= 1.4.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-test | >= 1.4.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-web | >= 1.4.0, < 1.7.0 |
1.7.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.inlong:manager-dao Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-dao</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-dao:1.7.0")
org.apache.inlong:manager-pojo Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-pojo</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-pojo:1.7.0")
org.apache.inlong:manager-service Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-service</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-service:1.7.0")
org.apache.inlong:manager-test Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-test</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-test:1.7.0")
org.apache.inlong:manager-web Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-web</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-web:1.7.0")
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-668: Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-98v7-xxxv-hcrh Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read | Critical | Also affects org.apache.inlong:manager-pojo |
| GHSA-532x-j9r7-8f73 Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass | Medium | Also affects org.apache.inlong:manager-pojo |
| GHSA-r324-vgr5-73c9 Apache InLong: JDBC Vulnerability during verification processing | Medium | Also affects org.apache.inlong:manager-pojo |
| GHSA-fgh3-pwmp-3qw3 Apache Inlong Deserialization of Untrusted Data vulnerability | Critical | Also affects org.apache.inlong:manager-pojo |
| GHSA-crwj-2r3c-gx2g Apache InLong Manager Arbitrary File Read Vulnerability | High | Also affects org.apache.inlong:manager-pojo |
| GHSA-9xg9-hh45-xcm6 Apache InLong Manager Remote Code Execution vulnerability | Critical | Also affects org.apache.inlong:manager-pojo |
| GHSA-jj32-3pf5-5mv5 Apache InLong Deserialization of Untrusted Data Vulnerability | High | Also affects org.apache.inlong:manager-pojo |
| GHSA-rp6x-ggw6-8g56 Authorization Bypass in Apache InLong | Critical | Also affects org.apache.inlong:manager-pojo |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor