CVE-2022-40955
published 2022-09-20CVE-2022-40955: In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data…
PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
2.14%
80.0th percentile
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | inlong | < 1.3.0 | 1.3.0 |
| apache_software_foundation | apache_inlong | >= Apache InLong < 1.3.0 | 1.3.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache InLong vulnerable to Deserialization of Untrusted Data
ghsa·2022-09-21
CVE-2022-40955 [HIGH] CWE-502 Apache InLong vulnerable to Deserialization of Untrusted Data
Apache InLong vulnerable to Deserialization of Untrusted Data
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.
OSV
Apache InLong vulnerable to Deserialization of Untrusted Data
osv·2022-09-21
CVE-2022-40955 [HIGH] Apache InLong vulnerable to Deserialization of Untrusted Data
Apache InLong vulnerable to Deserialization of Untrusted Data
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.
No detection rules found.
No public exploits indexed.
2022-09-20
Published