CVE-2022-40955: high-severity vulnerability in Apache InLong
Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 2.7%
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache InLongRelated CVEs — Apache InLong
In the same product, most dangerous first.
CVE-2023-43667HIGHApache InLong: Log Injection in Global functionsEPSS 1.7%CVE-2023-34434HIGHApache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath paramEPSS 1.7%CVE-2023-35088CRITICALApache InLong: SQL injection in audit endpointEPSS 1.6%CVE-2023-51784CRITICALApache InLong: Remote Code Execution vulnerability in Apache InLong ManagerEPSS 1.6%CVE-2023-27296HIGHApache InLong: JDBC Deserialization Vulnerability in InLongEPSS 1.5%CVE-2023-43668—Apache InLong: Jdbc Connection Security Bypass in InLongEPSS 1.4%