CVE-2023-35088: Apache InLong: SQL injection in audit endpoint
First published: Tue Jul 25 2023(Updated: )
Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. In the toAuditCkSql method, the groupId, streamId, auditId, and dt are directly concatenated into the SQL query statement, which may lead to SQL injection attacks. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8198
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache InLong | >=1.4.0<=1.7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-35088
- https://lists.apache.org/thread/os7b66x4n8dbtrdpb7c6x37bb1vjb0tk
- https://github.com/apache/inlong/pull/8198
- http://www.openwall.com/lists/oss-security/2023/07/25/4
- http://seclists.org/fulldisclosure/2023/Jul/43
- https://github.com/advisories/GHSA-r5pv-7g89-cxmc (Advisory)
- https://github.com/apache/inlong/commit/cab63a8eea6c0f4bf3d30ce245b7e1beee42504d
Frequently Asked Questions
What is CVE-2023-35088?
CVE-2023-35088 is a SQL injection vulnerability in Apache InLong, a software developed by the Apache Software Foundation.
How does CVE-2023-35088 affect Apache InLong?
CVE-2023-35088 affects Apache InLong versions 1.4.0 through 1.7.0.
What is the severity of CVE-2023-35088?
The severity of CVE-2023-35088 is classified as critical with a CVSS score of 9.8.
How can I fix CVE-2023-35088?
To fix CVE-2023-35088, it is recommended to upgrade Apache InLong to version 1.8.0 or apply patches provided by the Apache Software Foundation.
What is SQL injection?
SQL injection is a type of vulnerability that allows an attacker to manipulate SQL queries by inserting malicious SQL code.
- collector/oss-sec
- alias/CVE-2023-35088
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/nvd-latest
- agent/software-canonical-lookup-request
- agent/title
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r5pv-7g89-cxmc
- agent/references
- agent/last-modified-date
- collector/nvd-cve
- agent/tags
- collector/github-advisory
- vendor/apache
- canonical/apache inlong
- version/apache inlong/1.4.0
- version/apache inlong/1.7.0
- package-manager/maven