CVE-2023-43667
Assigner: apache
Published: 2023-10-16T08:08:01.762Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache InLong
vendor: Apache Software Foundation
versions: lessThanOrEqual: 1.8.0
status: affected
version: 1.4.0
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong.<p>This issue affects Apache InLong: from 1.4.0 through 1.8.0, the a<span style="background-color: rgb(255, 255, 255);">ttacker can create misleading or false records, making it harder to audit
and trace malicious activities.&nbsp;</span>Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it.</p><p>

<span style="background-color: rgb(255, 255, 255);">[1] </span><a target="_blank" rel="nofollow" href="https://github.com/apache/inlong/pull/8628">https://github.com/apache/inlong/pull/8628</a></p><p></p>
value: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false records, making it harder to audit
and trace malicious activities. Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/8628 


metrics: other: content: text: moderate
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
type: CWE
source: discovery: UNKNOWN
title: Apache InLong: Log Injection in Global functions
x_generator: engine: Vulnogram 0.1.0-dev