SB2023080118 - Multiple vulnerabilities in Apache InLong

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023080118

SB2023080118 - Multiple vulnerabilities in Apache InLong

Published: August 1, 2023

Security Bulletin ID SB2023080118
Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 9% Medium 55% Low 36%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 secuirty vulnerabilities.


1) Improper Authentication (CVE-ID: CVE-2023-31062)

The vulnerability allows a remote user to bypass authentication process.

The vulnerability exists due to an error in processing of authentication requests. A remote user with a valid cookie can bypass authentication process and gain unauthorized access to the privileged application parts.


2) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2023-31103)

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to missing access controls. A remote non-authenticated attacker can change the immutable name and type of cluster of InLong.


3) Insufficient Session Expiration (CVE-ID: CVE-2023-31065)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient session expiration issue. A remote non-authenticated attacker can obtain or guess session token and gain unauthorized access to session that belongs to another user. This includes sessions for accounts that have been deleted or the password has been changed.


4) Deserialization of Untrusted Data (CVE-ID: CVE-2023-31058)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


5) Improper access control (CVE-ID: CVE-2023-31454)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and bind any cluster.


6) Improper access control (CVE-ID: CVE-2023-31453)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and delete other users' subscriptions.


7) Improper access control (CVE-ID: CVE-2023-31206)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and change the immutable name and type of nodes.


8) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-31101)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to an error in the way new user registrations are handled. A remote newly registered user can see data of previously deleted users.


9) Weak password requirements (CVE-ID: CVE-2023-31098)

The vulnerability allows an attacker to perform brute-force attack and guess the password.

The vulnerability exists due to weak password requirements, as Apache InLong users can change their current passwords to a simple password strings. An attacker can perform a brute-force attack and guess users' passwords, which can result in application compromise.


10) Improper access control (CVE-ID: CVE-2023-31066)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and delete, edit, stop, and start others' sources.


11) Improper access control (CVE-ID: CVE-2023-31064)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and cancel applications of another users


Remediation

Install update from vendor's website.

References