What is GHSA-8rjh-3mhm-966q?

GHSA-8rjh-3mhm-966q is a security advisory published by GitHub Security Advisories with High severity. Apache InLong Incorrect Permission Assignment for Critical Resource Vulnerability

Which CVE IDs does GHSA-8rjh-3mhm-966q cover?

GHSA-8rjh-3mhm-966q covers the following CVE IDs: CVE-2023-31453. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8rjh-3mhm-966q?

GHSA-8rjh-3mhm-966q has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-8rjh-3mhm-966q?

GHSA-8rjh-3mhm-966q affects 2 products, including: maven/org.apache.inlong:manager-service:\u003e= 1.2.0, \u003c 1.7.0; maven/org.apache.inlong:manager-web:\u003e= 1.2.0, \u003c 1.7.0.

GHSA-8rjh-3mhm-966qHighCVSS 7.5

Apache InLong Incorrect Permission Assignment for Critical Resource Vulnerability

Vendor

GitHub Security Advisories

Published

July 6, 2023

Last Modified

November 10, 2023

🔗 CVE IDs covered (1)

CVE-2023-31453 →

📋 Description

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7949 to solve it.

🎯 Affected products2

maven/org.apache.inlong:manager-service:>= 1.2.0, < 1.7.0
maven/org.apache.inlong:manager-web:>= 1.2.0, < 1.7.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-31453
https://lists.apache.org/thread/9nz8o2skgc5230w276h4w92j0zstnl06
https://github.com/apache/inlong/pull/7949
https://github.com/advisories/GHSA-8rjh-3mhm-966q