CVE-2023-43667CWE-74

Apache InLong: Log Injection in Global functions

High · published October 16, 2023

CVSS v3.1
7.5
EPSS
2%
Percentile
77.2
In the wild
Unconfirmed
What it is

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log records, making it harder to audit

and trace malicious activities. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.

[1] https://github.com/apache/inlong/pull/8628

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01710 · 77.2th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2023-10-16T08:08Z
EPSS history
Timeline
  • 16 OCT 08:08Z
    Apache InLong: Log Injection in Global functions
    cvelistv5