GHSA-h79m-5cm2-278c CVE-2023-31101
User data exposure in Apache InLong
- Severity
- 6.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 1.11%
- Chance of exploitation in the next 30 days. Higher than 65.93% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1188 Initialization of a Resource with an Insecure Default
- Fix
- Available
- 4 packages have a fixed version
Description
Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0. Users registered in InLong who joined later can see deleted users' data. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 to solve it.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.inlong:manager-dao | >= 1.5.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-pojo | >= 1.5.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-service | >= 1.5.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-web | >= 1.5.0, < 1.7.0 |
1.7.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.inlong:manager-dao Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-dao</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-dao:1.7.0")
org.apache.inlong:manager-pojo Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-pojo</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-pojo:1.7.0")
org.apache.inlong:manager-service Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-service</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-service:1.7.0")
org.apache.inlong:manager-web Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-web</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-web:1.7.0")
Severity breakdown
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-1188: Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-98v7-xxxv-hcrh Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read | Critical | Also affects org.apache.inlong:manager-pojo |
| GHSA-532x-j9r7-8f73 Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass | Medium | Also affects org.apache.inlong:manager-pojo |
| GHSA-r324-vgr5-73c9 Apache InLong: JDBC Vulnerability during verification processing | Medium | Also affects org.apache.inlong:manager-pojo |
| GHSA-fgh3-pwmp-3qw3 Apache Inlong Deserialization of Untrusted Data vulnerability | Critical | Also affects org.apache.inlong:manager-pojo |
| GHSA-crwj-2r3c-gx2g Apache InLong Manager Arbitrary File Read Vulnerability | High | Also affects org.apache.inlong:manager-pojo |
| GHSA-9xg9-hh45-xcm6 Apache InLong Manager Remote Code Execution vulnerability | Critical | Also affects org.apache.inlong:manager-pojo |
| GHSA-jj32-3pf5-5mv5 Apache InLong Deserialization of Untrusted Data Vulnerability | High | Also affects org.apache.inlong:manager-pojo |
| GHSA-rp6x-ggw6-8g56 Authorization Bypass in Apache InLong | Critical | Also affects org.apache.inlong:manager-pojo |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor