CVE-2022-40955

Published: Sep 20, 2022Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.

Affected (1)

Products: Apache: Inlong

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Inlong	Before 1.3.0

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (4)

http://www.openwall.com/lists/oss-security/2022/09/22/5

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread/r1r34y7bchrpmp9jhfdoohzdmk7pj1q1

Source: security@apache.org

Issue TrackingMailing ListPatchVendor Advisory

http://www.openwall.com/lists/oss-security/2022/09/22/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.apache.org/thread/r1r34y7bchrpmp9jhfdoohzdmk7pj1q1

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingMailing ListPatchVendor Advisory

Timeline

No history available yet.