PT-2023-8729

CVE-2023-31058

Published

2023-05-21

Updated

2024-10-11

Description by

CVSS 2.0

High

MetricsAV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.4.0 through 1.6.0

Description The issue is related to the deserialization of untrusted data, which allows attackers to bypass the autoDeserialize option filtering by adding blanks. This can potentially lead to the execution of arbitrary code.

Recommendations To solve the issue, users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7674.

Exploitability

Fix

Impacts

Researchers

4Ra1N

H Ming

Sw0Rd1Ight

Vendors

Affected products

Weakness enumeration

CWE-502: Deserialization of Untrusted Data

CWE-20: Improper Input Validation