What is GHSA-rf76-whgp-fp56?

GHSA-rf76-whgp-fp56 is a security advisory published by GitHub Security Advisories with High severity. Apache InLong vulnerable to Incorrect Permission Assignment for Critical Resource

Which CVE IDs does GHSA-rf76-whgp-fp56 cover?

GHSA-rf76-whgp-fp56 covers the following CVE IDs: CVE-2023-31454. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rf76-whgp-fp56?

GHSA-rf76-whgp-fp56 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-rf76-whgp-fp56?

GHSA-rf76-whgp-fp56 affects 1 product, including: maven/org.apache.inlong:manager-service:\u003e= 1.2.0, \u003c 1.7.0.

GHSA-rf76-whgp-fp56HighCVSS 7.5

Apache InLong vulnerable to Incorrect Permission Assignment for Critical Resource

Vendor

GitHub Security Advisories

Published

July 6, 2023

Last Modified

November 10, 2023

🔗 CVE IDs covered (1)

CVE-2023-31454 →

📋 Description

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade to Apache InLong 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7947 to solve it.

🎯 Affected products1

maven/org.apache.inlong:manager-service:>= 1.2.0, < 1.7.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-31454
https://lists.apache.org/thread/nqt1tr6pbq8q4b033d7sg5gltx5pmjgl
https://github.com/apache/inlong/pull/7947
https://github.com/advisories/GHSA-rf76-whgp-fp56