PT-2023-28912

CVE-2023-43668

Published

2023-10-16

Updated

2023-11-14

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.8.0

Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability allows some sensitive parameter checks to be bypassed, including autoDeserizalize and allowLoadLocalInfile.

Recommendations For Apache InLong versions 1.4.0 through 1.8.0, upgrade to Apache InLong's 1.9.0 or cherry-pick the provided patch to solve the issue.

Exploitability

Fix

Impacts

Researchers

Nbxiglk

Vendors

Affected products

Weakness enumeration

CWE-502: Deserialization of Untrusted Data

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers

CVE-2023-43668