CVE-2023-31453: Apache InLong: IDOR make users can delete others' subscription
Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it.
[1]
https://github.com/apache/inlong/pull/7949 https://github.com/apache/inlong/pull/7949
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-31453?
CVE-2023-31453 is a vulnerability in Apache InLong that allows attackers to delete others' subscriptions even if they are not the owner.
Which software versions are affected by CVE-2023-31453?
Apache InLong versions 1.2.0 through 1.6.0 are affected by CVE-2023-31453.
What is the severity of CVE-2023-31453?
CVE-2023-31453 has a severity rating of 7.5 (high).
How can I fix CVE-2023-31453?
To fix CVE-2023-31453, users should update their Apache InLong installation to a version that is not affected by the vulnerability.
Where can I find more information about CVE-2023-31453?
More information about CVE-2023-31453 can be found at the following reference: [link](https://lists.apache.org/thread/9nz8o2skgc5230w276h4w92j0zstnl06).