CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2023-31453
High (7.5) in apache inlong. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in org.apache.inlong:manager-service 1.7.0.
Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner
of the deleted subscription. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it.
[1]
https://github.com/apache/inlong/pull/7949 https://github.com/apache/inlong/pull/7949
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-732
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:inlong
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8rjh-3mhm-966q | Maven | org.apache.inlong:manager-service | >=1.2.0 <1.7.0 | 1.7.0 |
| GHSA-8rjh-3mhm-966q | Maven | org.apache.inlong:manager-web | >=1.2.0 <1.7.0 | 1.7.0 |