PT-2023-8729

CVE-2023-31058

Publicado

2023-05-21

Atualizado

2024-10-11

Descrição por

CVSS 2.0

Alta

MétricasAV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.6.0

Description The issue is related to the deserialization of untrusted data, which allows attackers to bypass the autoDeserialize option filtering by adding blanks. This can potentially lead to the execution of arbitrary code.

Recommendations To solve the issue, users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7674.

Explorabilidade

Correção

Impactos

Pesquisadores

4Ra1N

H Ming

Sw0Rd1Ight

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-502: Deserialization of Untrusted Data

CWE-20: Improper Input Validation