CVE-2023-31062

CWE-269 — Improper Privilege Management4 documents4 sources

Severity

9.8CRITICAL

EPSS

0.3%

top 49.94%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Software Foundation Apache Inlong Apache Inlong

Timeline

PublishedMay 22

Latest updateJul 6

Description

Improper Privilege Management Vulnerabilities in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. When the attacker has access to a valid (but unprivileged) account, the exploit can be executed using Burp Suite by sending a login request and following it with a subsequent HTTP request using the returned cookie. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apa…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5apache_software_foundation/apache_inlong1.2.0 — 1.6.0

▶Mavenorg.apache.inlong:manager-dao1.2.0 — 1.7.0

▶Mavenorg.apache.inlong:manager-web1.2.0 — 1.7.0

▶Mavenorg.apache.inlong:manager-pojo1.2.0 — 1.7.0

▶Mavenorg.apache.inlong:manager-service1.2.0 — 1.7.0

🔴Vulnerability Details

GHSA

Apache InLong Improper Privilege Management vulnerability↗2023-07-06

▶

OSV

Apache InLong Improper Privilege Management vulnerability↗2023-07-06

▶

CVEList

Apache InLong: Privilege escalation vulnerability for InLong↗2023-05-22

▶