CVE-2024-26580: Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.10.0, the attackers can
use the specific payload to read from an arbitrary file. Users are advised to upgrade to Apache InLong's 1.11.0 or cherry-pick [1] to solve it.
[1] https://github.com/apache/inlong/pull/9673
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26580?
CVE-2024-26580 is classified as a critical vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2024-26580?
To mitigate CVE-2024-26580, upgrade to Apache InLong version 1.11.0.
Which versions of Apache InLong are affected by CVE-2024-26580?
CVE-2024-26580 affects Apache InLong versions from 1.8.0 to 1.10.0.
What is the nature of CVE-2024-26580 vulnerability?
CVE-2024-26580 is a deserialization of untrusted data vulnerability that allows attackers to read from arbitrary files.
Can I cherry-pick a patch for CVE-2024-26580 instead of upgrading?
Yes, users can cherry-pick specific patches to resolve CVE-2024-26580 if they cannot upgrade to version 1.11.0.