GHSA-86pw-4rqp-6x7v

Apache InLong: General user can delete and update process

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-34189

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.inlong:inlong-manager	>= 1.4.0, < 1.8.0	1.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could use general users to delete and update the process, which only the admin can operate occurrences. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8109 to solve it.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-34189 advisory
https://github.com/apache/inlong/issues/8108 web
https://github.com/apache/inlong/pull/8109 web
https://github.com/apache/inlong package
https://lists.apache.org/thread/smxqyx43hxjvzv4w71n2n3rfho9p378s web
http://www.openwall.com/lists/oss-security/2023/07/25/2 web