CVE-2023-35088: Apache InLong: SQL injection in audit endpoint
Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. In the toAuditCkSql method, the groupId, streamId, auditId, and dt are directly concatenated into the SQL query statement, which may lead to SQL injection attacks. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/8198
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-35088?
CVE-2023-35088 is a SQL injection vulnerability in Apache InLong, a software developed by the Apache Software Foundation.
How does CVE-2023-35088 affect Apache InLong?
CVE-2023-35088 affects Apache InLong versions 1.4.0 through 1.7.0.
What is the severity of CVE-2023-35088?
The severity of CVE-2023-35088 is classified as critical with a CVSS score of 9.8.
How can I fix CVE-2023-35088?
To fix CVE-2023-35088, it is recommended to upgrade Apache InLong to version 1.8.0 or apply patches provided by the Apache Software Foundation.
What is SQL injection?
SQL injection is a type of vulnerability that allows an attacker to manipulate SQL queries by inserting malicious SQL code.