CVE-2023-51785

CWE-502 — Deserialization of Untrusted Data4 documents4 sources
Severity
7.5HIGH
EPSS
0.3%
top 46.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache InlongApache Inlong
Timeline
PublishedJan 3

Description

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/9331

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Mavenorg.apache.inlong:manager-pojo1.5.0 — 1.10.0
▶NVDapache/inlong1.7.0 — 1.9.0
▶CVEListV5apache_software_foundation/apache_inlong1.7.0 — 1.9.0

🔴Vulnerability Details

3
OSV
Apache InLong Manager Arbitrary File Read Vulnerability↗2024-01-03
▶
CVEList
Apache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager↗2024-01-03
▶
GHSA
Apache InLong Manager Arbitrary File Read Vulnerability↗2024-01-03
▶
CVE-2023-51785 (HIGH CVSS 7.5) | Deserialization of Untrusted Data v | cvebase.io