CVE-2023-31098
Assigner: apache
Published: 2023-05-22T15:31:53.989Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache InLong
vendor: Apache Software Foundation
versions: lessThanOrEqual: 1.6.0
status: affected
version: 1.1.0
versionType: semver
credits: type: finder
value: lujie.ac.cn
descriptions: supportingMedia: base64: no
type: text/html
value: Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.<p>This issue affects Apache InLong: from 1.1.0 through 1.6.0.&nbsp;

<span style="background-color: rgb(255, 255, 255);">When users change their password to a simple password (with any character or
symbol), attackers can easily guess the user's password and access the account.</span></p><p>Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick <a target="_blank" rel="nofollow" href="https://github.com/apache/inlong/pull/7805">https://github.com/apache/inlong/pull/7805</a> to solve it.<br></p>
value: Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0. 

When users change their password to a simple password (with any character or
symbol), attackers can easily guess the user's password and access the account.

Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick  https://github.com/apache/inlong/pull/7805 https://github.com/apache/inlong/pull/7805  to solve it.



metrics: other: content: text: moderate
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-521
description: CWE-521 Weak Password Requirements
type: CWE
source: discovery: UNKNOWN
title: Apache InLong: Weak Password Implementation in InLong
x_generator: engine: Vulnogram 0.1.0-dev