CVE-2023-30465: Apache InLong: SQL injection in apache inLong 1.5.0
First published: Tue Apr 11 2023(Updated: )
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.5.0. By manipulating the "orderType" parameter and the ordering of the returned content using an SQL injection attack, an attacker can extract the username of the user with ID 1 from the "user" table, one character at a time. Users are advised to upgrade to Apache InLong's 1.6.0 or cherry-pick [1] to solve it. https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html [1] https://github.com/apache/inlong/issues/7529 https://github.com/apache/inlong/issues/7529
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache InLong | =1.4.0 | |
| Apache InLong | =1.5.0 | |
| maven/org.apache.inlong:manager-service | >=1.4.0<1.6.0 | 1.6.0 |
| maven/org.apache.inlong:manager-pojo | >=1.4.0<1.6.0 | 1.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2023/04/11/2
- https://lists.apache.org/thread/mrh4nr3jrlbj6nxkn4q8hddbfh1pnok0
- https://nvd.nist.gov/vuln/detail/CVE-2023-30465
- https://github.com/apache/inlong/issues/7529
- https://github.com/apache/inlong/pull/7530
- https://inlong.apache.org/zh-CN/download/release-1.6.0
- https://github.com/advisories/GHSA-cqr6-3x3f-9wr3 (Advisory)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-30465.
What software does this vulnerability affect?
This vulnerability affects Apache InLong versions 1.4.0 through 1.5.0.
What is the severity of CVE-2023-30465?
The severity of CVE-2023-30465 is medium with a CVSS score of 5.3.
How does this vulnerability manifest?
This vulnerability is an SQL injection vulnerability in Apache InLong, which can be exploited by manipulating the 'orderType' parameter and the ordering of the returned content using an SQL command.
How can I mitigate CVE-2023-30465?
To mitigate CVE-2023-30465, it is recommended to update Apache InLong to version 1.5.1 or later, which contains a fix for this vulnerability.
- collector/nvd-index
- agent/type
- agent/title
- agent/weakness
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-cqr6-3x3f-9wr3
- alias/CVE-2023-30465
- agent/severity
- agent/references
- agent/last-modified-date
- agent/description
- agent/event
- agent/softwarecombine
- collector/nvd-cve
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/apache
- canonical/apache inlong
- version/apache inlong/1.4.0
- version/apache inlong/1.5.0
- package-manager/maven