Apache InLong: Weak Password Implementation in InLong
CVE-2023-31098

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache Inlong
Vendor
CVE Published:
22 May 2023

What is CVE-2023-31098?

The Apache InLong application has a weakness in its password creation policy, allowing users to set simple passwords that can be easily guessed by attackers. This vulnerability affects versions 1.1.0 through 1.6.0. Users are strongly encouraged to upgrade to version 1.7.0 or manually apply recommended patches to ensure better account security.

Affected Version(s)

Apache InLong 1.1.0 <= 1.6.0

References

https://lists.apache.org/thread/1fvloc3no1gbffzrcsx9ltsg0...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lujie.ac.cn
.