CVE-2023-43668 Apache InLong: Jdbc Connection Security Bypass in InLong

2023-10-1608:07:42

CWE-639

apache

github.com

apache inlong

security bypass

jdbc connection

upgrade

authorization bypass

AI Score

9.4

Confidence

High

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,

some sensitive params checks will be bypassed, like “autoDeserizalize”,“allowLoadLocalInfile”…

Users are advised to upgrade to Apache InLong’s 1.9.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/8604

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apache",
    "product": "inlong",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.0",
        "lessThan": "1.8.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]