GHSA-q5p5-xg93-2jqc CVE-2023-31062
Apache InLong Improper Privilege Management vulnerability
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 1.29%
- Chance of exploitation in the next 30 days. Higher than 70.22% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-269 Improper Privilege Management
- Fix
- Available
- 4 packages have a fixed version
Description
Improper Privilege Management Vulnerabilities in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. When the attacker has access to a valid (but unprivileged) account, the exploit can be executed using Burp Suite by sending a login request and following it with a subsequent HTTP request using the returned cookie.
Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 to solve it.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.inlong:manager-dao | >= 1.2.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-pojo | >= 1.2.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-service | >= 1.2.0, < 1.7.0 |
1.7.0 |
| org.apache.inlong:manager-web | >= 1.2.0, < 1.7.0 |
1.7.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.inlong:manager-dao Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-dao</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-dao:1.7.0")
org.apache.inlong:manager-pojo Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-pojo</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-pojo:1.7.0")
org.apache.inlong:manager-service Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-service</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-service:1.7.0")
org.apache.inlong:manager-web Maven → 1.7.0
- maven
<dependency><groupId>org.apache.inlong</groupId><artifactId>manager-web</artifactId><version>1.7.0</version></dependency>- gradle
implementation("org.apache.inlong:manager-web:1.7.0")
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
- Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-98v7-xxxv-hcrh Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read | Critical | Also affects org.apache.inlong:manager-pojo |
| GHSA-532x-j9r7-8f73 Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass | Medium | Also affects org.apache.inlong:manager-pojo |
| GHSA-r324-vgr5-73c9 Apache InLong: JDBC Vulnerability during verification processing | Medium | Also affects org.apache.inlong:manager-pojo |
| GHSA-fgh3-pwmp-3qw3 Apache Inlong Deserialization of Untrusted Data vulnerability | Critical | Also affects org.apache.inlong:manager-pojo |
| GHSA-crwj-2r3c-gx2g Apache InLong Manager Arbitrary File Read Vulnerability | High | Also affects org.apache.inlong:manager-pojo |
| GHSA-9xg9-hh45-xcm6 Apache InLong Manager Remote Code Execution vulnerability | Critical | Also affects org.apache.inlong:manager-pojo |
| GHSA-jj32-3pf5-5mv5 Apache InLong Deserialization of Untrusted Data Vulnerability | High | Also affects org.apache.inlong:manager-pojo |
| GHSA-rp6x-ggw6-8g56 Authorization Bypass in Apache InLong | Critical | Also affects org.apache.inlong:manager-pojo |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor