CVE-2022-40955 - Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC

Back Back to CVE browser

HIGH

Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC

Published Sep 20, 2022

8.8

HIGH

CVSS 3.1

EPSS 2.71%

Description

In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.

Affected products

Vendor Apache Software Foundation Product Apache InLong Default
n/a
- Version
  Apache InLong
  Status
  affected
  Constraints
  <1.3.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache InLong

n/a

Version	Status	Constraints
Apache InLong	affected	<1.3.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (5)

http://www.openwall.com/lists/oss-security/2022/09/22/5
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6654
Advisory
https://github.com/advisories/GHSA-26m4-qjp9-xmc6
Advisory
https://lists.apache.org/thread/r1r34y7bchrpmp9jhfdoohzdmk7pj1q1
x_refsource_MISCIssue TrackingMailing ListPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-40955

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2022/09/22/5		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6654		Advisory
https://github.com/advisories/GHSA-26m4-qjp9-xmc6		Advisory
https://lists.apache.org/thread/r1r34y7bchrpmp9jhfdoohzdmk7pj1q1		x_refsource_MISCIssue TrackingMailing ListPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-40955