GitHub Advisory DatabaseGHSA-CQR6-3X3F-9WR3Apache InLong SQL Injection vulnerability
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
0.002 Low
EPSS
Percentile
56.0%
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.5.0. By manipulating the “orderType” parameter and the ordering of the returned content using an SQL injection attack, an attacker can extract the username of the user with ID 1 from the “user” table, one character at a time. Users are advised to upgrade to Apache InLong’s 1.6.0 or cherry-pick PR #7530 to solve it.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.apache.inlong:manager-service | lt | 1.6.0 | |
| org.apache.inlong:manager-pojo | lt | 1.6.0 |
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
0.002 Low
EPSS
Percentile
56.0%