PT-2023-5268

CVE-2023-34434

Publicado

2023-07-25

Atualizado

2024-10-02

Descrição por

CVSS 4.0

8.7

Alta

MétricasAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.7.0

Description The issue affects Apache InLong, allowing an attacker to bypass the current logic and achieve arbitrary file reading by exploiting a deserialization of untrusted data vulnerability. This could enable a remote attacker to read files arbitrarily.

Recommendations To solve this issue, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130.

Explorabilidade

Correção

Impactos

Pesquisadores

4Ra1N

Sw0Rd1Ight

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-502: Deserialization of Untrusted Data

Identificadores relacionados

CVE-2023-34434