Arbitrary File Read

org.apache.inlong: manager-pojo is vulnerable to Arbitrary File Read. The vulnerability is caused due to lack of validation performed while deserializing untrusted data. An attacker can perform an arbitrary file read using mysql driver...

Deserialization Of Untrusted Data

org.apache.inlong: manager-pojo is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to filterSensitive function in MySQLSinkDTO.java not properly sanitizing whitespace characters, especially the horizontal tab \t, in URL parameters, which allows these characters to bypass...

Information Disclosure

org.apache.inlong: manager-web is vulnerable to Information Disclosure. The vulnerability is due to the list and getByName functions in UserController.java lacking Role-Based Access Control. This allows any authenticated user to access data that meant for admin regardless of their role...

Privilege Escalation

org.apache.inlong is vulnerable to Privilege Escalation. The vulnerability exists because the library does not properly remove the permission when deleting a user, allowing an attacker with a valid but unprivileged account to send malicious login requests and follow it with a subsequent HTTP...

Insecure Direct Object References (IDOR)

org.apache.inlong is vulnerable to Insecure Direct Object References IDOR. The vulnerability exists due to a lack of permission verification for stream sources, which allows an attacker to access files or directories of external users and delete, edit, stop, and start others' sources...

SQL Injection

org.apache.inlong:manager-service is vulnerable to SQL Injection attacks. A specifically crafted attack statement through the orderType parameter in InlongGroupServiceImpl.java allows a malicious user to inject and execute arbitrary SQL queries on the target system...

Out-Of-Bounds Read

org.apache.inlong, manager-pojo is vulnerable to Out-Of-Bounds Reads. An out-of-bounds read vulnerability exists in MySQLSinkDTO.java which may lead to exfiltration of memory resulting in disclosure of sensitive information...