PT-2023-28912

CVE-2023-43668

Publicado

2023-10-16

Atualizado

2023-11-14

Descrição por

CVSS 3.1

9.8

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.8.0

Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability allows some sensitive parameter checks to be bypassed, including autoDeserizalize and allowLoadLocalInfile.

Recommendations For Apache InLong versions 1.4.0 through 1.8.0, upgrade to Apache InLong's 1.9.0 or cherry-pick the provided patch to solve the issue.

Explorabilidade

Correção

Impactos

Pesquisadores

Nbxiglk

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-502: Deserialization of Untrusted Data

CWE-639: Authorization Bypass Through User-Controlled Key

Identificadores relacionados

CVE-2023-43668