CVE-2023-35088

Katalog CVE

CVSS 9.8 · Critical EPSS 1,6%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada apache inlong. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.  In the toAuditCkSql method, the groupId, streamId, auditId, and dt are directly concatenated into the SQL query statement, which may lead to SQL injection attacks. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8198

Rincian

Terbit di NVD

25 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/os7b66x4n8dbtrdpb7c6x37bb1vjb0tk mailing list · advisory vendor
• http://seclists.org/fulldisclosure/2023/Jul/43 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2023/07/25/4 mailing list · advisory pihak ketiga