CVE-2023-43668

Published: Oct 16, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile".... . Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8604

Affected (1)

Products: Apache: Inlong

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Inlong	From 1.4.0 to 1.8.0

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://lists.apache.org/thread/16gtk7rpdm1rof075ro83fkrnhbzn5sh

Source: security@apache.org

Mailing ListVendor Advisory

https://lists.apache.org/thread/16gtk7rpdm1rof075ro83fkrnhbzn5sh

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.