Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03NTdwLTdocDUtcHFtcs4AA0c6

Apache InLong Insufficient Session Expiration vulnerability

Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. 

An old session can be used by an attacker even after the user has been deleted or the password has been changed.

Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 or https://github.com/apache/inlong/pull/7884 to solve it.

Permalink: https://github.com/advisories/GHSA-757p-7hp5-pqmr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NTdwLTdocDUtcHFtcs4AA0c6
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 1 year ago
Updated: about 1 year ago

CVSS Score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Percentage: 0.00503
EPSS Percentile: 0.76215

Identifiers: GHSA-757p-7hp5-pqmr, CVE-2023-31065
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-31065
• https://lists.apache.org/thread/to7o0n2cks0omtwo6mhh5cs2vfdbplqf
• https://github.com/apache/inlong/pull/7836
• https://github.com/apache/inlong/pull/7884
• https://github.com/advisories/GHSA-757p-7hp5-pqmr

Repository: https://github.com/apache/inlong
Blast Radius: 14.1

Affected Packages