CVE-2023-34434CWE-502

Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param

High · published July 25, 2023

CVSS v3.1
7.5
EPSS
2%
Percentile
77.0
In the wild
Unconfirmed
What it is

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.

The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01701 · 77.0th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2023-07-25T07:09Z
EPSS history
Timeline
  • 25 JUL 07:09Z
    Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param
    cvelistv5