{"id":"CVE-2023-43668","published":"2023-10-16T08:07:42Z","modified":"2024-09-16T18:25:25Z","title":"Apache InLong: Jdbc Connection Security Bypass in InLong","vendor":"Apache","product":"Apache InLong","tier":"tail","description":{"text":"Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, \n\nsome sensitive params  checks will be bypassed, like \"autoDeserizalize\",\"allowLoadLocalInfile\"....\n\n.  \n\nUsers are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/8604 \n\n","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0143,"percentile":0.72989,"provenance":"source"},"cwes":[{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"}],"references":[{"url":"https://lists.apache.org/thread/16gtk7rpdm1rof075ro83fkrnhbzn5sh","tags":["vendor-advisory"]}],"priority":{"score":14.6,"factors":[{"name":"EPSS percentile","points":14.6}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache InLong","versions":[">= 1.4.0, <= 1.8.0"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.inlong:manager-pojo","vulnerableRanges":[">=1.4.0, <1.9.0"],"patched":["1.9.0"],"from":["GHSA-rp6x-ggw6-8g56"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2805","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-inlong-cve-2023-34434","parents":[{"from":"CVE-2023-34434","to":"CVE-2023-43668","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.inlong:manager-pojo","fromFixed":"1.8.0","toFixed":"1.9.0","daysApart":83},{"kind":"same-code","provenance":"machine","files":["inlong-manager/manager-pojo/src/main/java/org/apache/inlong/manager/pojo/sink/mysql/MySQLSinkDTO.java"],"commits":["https://github.com/apache/inlong/commit/34835f827771074345f42a9b1658d018f202516e","https://github.com/apache/inlong/commit/46c4e96a84839bd540f47c659c9d8576e393da02"],"basis":"shared function","functions":["filterSensitive"]}]}],"children":[{"from":"CVE-2023-43668","to":"CVE-2023-51785","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["inlong-manager/manager-pojo/src/main/java/org/apache/inlong/manager/pojo/sink/mysql/MySQLSinkDTO.java"],"commits":["https://github.com/apache/inlong/commit/46c4e96a84839bd540f47c659c9d8576e393da02","https://github.com/apache/inlong/commit/d674bfe28416aff728eabafc1f6b8bb9ba5a5b8e"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2023-31103","published":"2023-05-22","fixed":"1.7.0","kev":false},{"cve":"CVE-2023-31206","published":"2023-05-22","fixed":"1.7.0","kev":false},{"cve":"CVE-2023-34434","published":"2023-07-25","fixed":"1.8.0","kev":false},{"cve":"CVE-2023-43668","published":"2023-10-16","fixed":"1.9.0","kev":false},{"cve":"CVE-2023-46227","published":"2023-10-19","fixed":"1.9.0","kev":false},{"cve":"CVE-2023-51784","published":"2024-01-03","fixed":"1.10.0","kev":false},{"cve":"CVE-2023-51785","published":"2024-01-03","fixed":"1.10.0","kev":false}],"package":"Maven:org.apache.inlong:manager-pojo"}}