CVE-2023-31454 - OpenCVE

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it.[1] https://github.com/apache/inlong/pull/7947 https://github.com/apache/inlong/pull/7947

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apache	Inlong

Configuration 1 [-]

cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://lists.apache.org/thread/nqt1tr6pbq8q4b033d7sg5gltx5pmjgl

History

No history.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2023-05-22T13:23:17.332Z

Updated: 2024-08-02T14:53:30.874Z

Reserved: 2023-04-28T09:57:36.175Z

Link: CVE-2023-31454

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-05-22T14:15:09.697

Modified: 2023-05-27T01:26:39.903

Link: CVE-2023-31454

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-31454", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2023-04-28T09:57:36.175Z", "datePublished": "2023-05-22T13:23:17.332Z", "dateUpdated": "2024-08-02T14:53:30.874Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache InLong", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.6.0", "status": "affected", "version": "1.2.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.<p>This issue affects Apache InLong: from 1.2.0 through 1.6.0. \n\n<span style=\"background-color: rgb(255, 255, 255);\">The attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it.[1]</span><br><br><a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/inlong/pull/7947\">https://github.com/apache/inlong/pull/7947</a>\n\n</p>"}], "value": "Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0.\u00a0\n\nThe attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it.[1]\n\n https://github.com/apache/inlong/pull/7947 https://github.com/apache/inlong/pull/7947 \n\n\n\n"}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2023-05-22T13:23:17.332Z"}, "references": [{"url": "https://lists.apache.org/thread/nqt1tr6pbq8q4b033d7sg5gltx5pmjgl"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache InLong: IDOR make users can bind any cluster", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:53:30.874Z"}, "title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/nqt1tr6pbq8q4b033d7sg5gltx5pmjgl", "tags": ["x_transferred"]}]}]}}