CVE-2023-31453

CVE-2023-31453: Apache InLong: IDOR make users can delete others' subscription

Vendor Apache Software Foundation
Product Apache InLong
Weakness CWE-732
Published May 22, 2023
Last update October 11, 2024

CVSS base score

What the vulnerability does

Description

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/7949 https://github.com/apache/inlong/pull/7949

Key dates

Disclosure timeline

May 22, 2023 CVE published
October 11, 2024 Record updated