CVE-2024-26580
published 2024-03-06CVE-2024-26580: Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can use the…
PriorityP260critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
1.22%
65.5th percentile
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can
use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/9673
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | inlong | >= 1.4.0 < 1.11.0 | 1.11.0 |
| apache_software_foundation | apache_inlong | 1.4.0 – 1.10.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability
osv·2024-03-06
CVE-2024-26580 [CRITICAL] Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability
Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can
use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/9673
GHSA
Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability
ghsa·2024-03-06
CVE-2024-26580 [CRITICAL] CWE-502 Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability
Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can
use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/9673
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-03-06
Published