CVE-2023-43667: Apache InLong: Log Injection in Global functions
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log records, making it harder to audit and trace malicious activities. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/8628
Other sources
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false records, making it harder to audit and trace malicious activities. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/8628
— GitHub
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false records, making it harder to audit and trace malicious activities. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/8628
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-43667?
CVE-2023-43667 is a vulnerability in Apache InLong that allows SQL injection, leading to the creation of misleading or false records and making it harder to audit and trace malicious activities.
Which software versions are affected by CVE-2023-43667?
Versions 1.4.0 through 1.8.0 of Apache InLong are affected by CVE-2023-43667.
How can an attacker exploit CVE-2023-43667?
An attacker can exploit CVE-2023-43667 by injecting special elements into SQL commands, leading to SQL injection and the creation of misleading or false records.
How can I fix CVE-2023-43667?
To fix CVE-2023-43667, upgrade Apache InLong to version 1.8.0 or apply the latest patch provided by the Apache InLong project.
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-43667?
The CWE ID for CVE-2023-43667 is CWE-89, which refers to improper neutralization of special elements used in an SQL command ('SQL injection').