CVE-2023-34434
published 2023-07-25CVE-2023-34434: Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.32%
67.5th percentile
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.
The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | inlong | 1.4.0 – 1.7.0 | — |
| apache_software_foundation | apache_inlong | 1.4.0 – 1.7.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
JDBC URL bypassing by allowLoadLocalInfileInPath param
ghsa·2023-07-25
CVE-2023-34434 [HIGH] CWE-502 JDBC URL bypassing by allowLoadLocalInfileInPath param
JDBC URL bypassing by allowLoadLocalInfileInPath param
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.
The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .
OSV
JDBC URL bypassing by allowLoadLocalInfileInPath param
osv·2023-07-25
CVE-2023-34434 [HIGH] JDBC URL bypassing by allowLoadLocalInfileInPath param
JDBC URL bypassing by allowLoadLocalInfileInPath param
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.
The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://seclists.org/fulldisclosure/2023/Jul/43http://www.openwall.com/lists/oss-security/2023/07/25/3https://lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4johttp://seclists.org/fulldisclosure/2023/Jul/43http://www.openwall.com/lists/oss-security/2023/07/25/3https://lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo
2023-07-25
Published