Apache InLong Insufficient Session Expiration vulnerability

2023-07-0621:14:59

CWE-613

GitHub Advisory Database

github.com

apache inlong

vulnerability

session expiration

upgrade

github

security fix

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.003

Percentile

65.3%

JSON

Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.

An old session can be used by an attacker even after the user has been deleted or the password has been changed.

Users are advised to upgrade to Apache InLong’s 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 or https://github.com/apache/inlong/pull/7884 to solve it.

Affected configurations

Vulners

Node

org.apache.inlongmanager-serviceRange1.4.0–1.7.0

org.apache.inlongmanager-webRange1.4.0–1.7.0

org.apache.inlongmanager-daoRange1.4.0–1.7.0

org.apache.inlongmanager-pojoRange1.4.0–1.7.0

VendorProductVersionCPE
org.apache.inlongmanager-service*cpe:2.3:a:org.apache.inlong:manager-service:*:*:*:*:*:*:*:*
org.apache.inlongmanager-web*cpe:2.3:a:org.apache.inlong:manager-web:*:*:*:*:*:*:*:*
org.apache.inlongmanager-dao*cpe:2.3:a:org.apache.inlong:manager-dao:*:*:*:*:*:*:*:*
org.apache.inlongmanager-pojo*cpe:2.3:a:org.apache.inlong:manager-pojo:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.apache.inlong	manager-service	*	cpe:2.3:a:org.apache.inlong:manager-service::::::::
org.apache.inlong	manager-web	*	cpe:2.3:a:org.apache.inlong:manager-web::::::::
org.apache.inlong	manager-dao	*	cpe:2.3:a:org.apache.inlong:manager-dao::::::::
org.apache.inlong	manager-pojo	*	cpe:2.3:a:org.apache.inlong:manager-pojo::::::::