CVE-2023-34434

CWE-502 — Deserialization of Untrusted Data4 documents4 sources

Severity

7.5HIGH

EPSS

0.3%

top 50.99%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Software Foundation Apache Inlong Apache Inlong

Timeline

PublishedJul 25

Description

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5apache_software_foundation/apache_inlong1.4.0 — 1.7.0

▶Mavenorg.apache.inlong:manager-pojo1.4.0 — 1.8.0

▶NVDapache/inlong1.4.0 — 1.7.0

🔴Vulnerability Details

GHSA

JDBC URL bypassing by allowLoadLocalInfileInPath param↗2023-07-25

▶

CVEList

Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param↗2023-07-25

▶

OSV

JDBC URL bypassing by allowLoadLocalInfileInPath param↗2023-07-25

▶