CVE-2023-27296CWE-502

Apache InLong: JDBC Deserialization Vulnerability in InLong

High · published March 27, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
73.6
In the wild
Unconfirmed
What it is

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.

It could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability.

This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it.

[1]  https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html

https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html

[2] https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01475 · 73.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2023-03-27T14:10Z
EPSS history
Timeline
  • 27 MAR 14:10Z
    Apache InLong: JDBC Deserialization Vulnerability in InLong
    cvelistv5