CVE-2024-26580 Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability

2024-03-0612:07:28

CWE-502

apache

github.com

cve-2024-26580

apache inlong

arbitrary file read

deserialization vulnerability

untrusted data

upgrade

1.8.0

1.10.0

1.11.0

AI Score

6.4

Confidence

High

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can

use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong’s 1.11.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/9673

CNA Affected

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache InLong",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.0",
        "versionType": "semver",
        "lessThanOrEqual": "1.10.0"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apache:inlong:1.4.0:*:*:*:*:*:*:*"
    ],
    "vendor": "apache",
    "product": "inlong",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.0",
        "versionType": "semver",
        "lessThanOrEqual": "1.10.0"
      }
    ],
    "defaultStatus": "unaffected"
  }
]