CVE-2023-31098: Apache InLong: Weak Password Implementation in InLong
Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0.
When users change their password to a simple password (with any character or symbol), attackers can easily guess the user's password and access the account.
Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7805 https://github.com/apache/inlong/pull/7805 to solve it.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-31098.
What is the title of the vulnerability?
The title of the vulnerability is Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.
What is the affected software?
The affected software is Apache InLong version 1.1.0 through 1.6.0.
What is the severity of the vulnerability?
The severity of the vulnerability is critical with a CVSS score of 9.8.
How can an attacker exploit this vulnerability?
An attacker can easily guess a user's password when they change it to a simple password with any character or symbol, allowing them to access the account.
Is there a fix available for this vulnerability?
Yes, it is recommended to upgrade Apache InLong to a version beyond 1.6.0 to fix this vulnerability.