CVE-2023-34434
Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param
Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .
Reserved 2023-06-06 | Published 2023-07-25 | Updated 2025-02-13 | Assigner apacheCWE-502 Deserialization of Untrusted Data
sw0rd1ight and 4ra1n of Chaitin Tech
lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo
seclists.org/fulldisclosure/2023/Jul/43
www.openwall.com/lists/oss-security/2023/07/25/3
Support options
