Lookup for vulnerable packages by Package URL.
| Purl | pkg:maven/org.apache.inlong/inlong@1.4.0 |
|---|
| Type | maven |
|---|
| Namespace | org.apache.inlong |
|---|
| Name | inlong |
|---|
| Version | 1.4.0 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 1.9.0 |
|---|
| Latest_non_vulnerable_version | 1.9.0 |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-3hdc-nf2z-7kcv |
| vulnerability_id |
VCID-3hdc-nf2z-7kcv |
| summary |
SQL Injection in Apache InLong
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false records, making it harder to audit
and trace malicious activities. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/8628 |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-43667, GHSA-fpcf-qr79-hjqp
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3hdc-nf2z-7kcv |
|
| 1 |
| url |
VCID-72bg-5x2f-f7dz |
| vulnerability_id |
VCID-72bg-5x2f-f7dz |
| summary |
Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,
some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile"....
.
Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/8604 |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-43668, GHSA-rp6x-ggw6-8g56
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-72bg-5x2f-f7dz |
|
| 2 |
| url |
VCID-m8t8-kcwm-5fb7 |
| vulnerability_id |
VCID-m8t8-kcwm-5fb7 |
| summary |
Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0,
General user can view all user data like Admin account.
Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/8623 |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-43666, GHSA-wj6q-chpv-mcrx
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-m8t8-kcwm-5fb7 |
|
| 3 |
| url |
VCID-mtrm-cwsb-kkeu |
| vulnerability_id |
VCID-mtrm-cwsb-kkeu |
| summary |
Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7214 https://github.com/apache/inlong/pull/7214 to solve it. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-24977, GHSA-q9p5-w2v9-6wxf
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mtrm-cwsb-kkeu |
|
| 4 |
| url |
VCID-zdct-pkqv-bbhw |
| vulnerability_id |
VCID-zdct-pkqv-bbhw |
| summary |
Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7223 https://github.com/apache/inlong/pull/7223 to solve it. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-24997, GHSA-22j4-qc48-j8f8
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zdct-pkqv-bbhw |
|
|
|---|
| Fixing_vulnerabilities |
|
|---|
| Risk_score | 4.5 |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.inlong/inlong@1.4.0 |
|---|