Apache InLong Insufficient Session Expiration vulnerability

緊急 9.1CVE-2023-31065 · GHSA-757p-7hp5-pqmr · 22/05/2023 公開 · 17/06/2026 更新

要点

CVE-2023-31065 は org.apache.inlong:manager-dao, org.apache.inlong:manager-pojo, org.apache.inlong:manager-service に影響する深刻度「緊急」 (CVSS 9.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.2%（全脆弱性の 67.2% より高い）。
対処：1.7.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.inlong:manager-dao Maven	`≥ 1.4.0, < 1.7.0`	`1.7.0`
org.apache.inlong:manager-pojo Maven	`≥ 1.4.0, < 1.7.0`	`1.7.0`
org.apache.inlong:manager-service Maven	`≥ 1.4.0, < 1.7.0`	`1.7.0`
org.apache.inlong:manager-web Maven	`≥ 1.4.0, < 1.7.0`	`1.7.0`
inlong apache	`≥ 1.4.0, ≤ 1.6.0`	修正版なし

概要

Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.

An old session can be used by an attacker even after the user has been deleted or the password has been changed.

Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 or https://github.com/apache/inlong/pull/7884 to solve it.

NVD の説明

Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. An old session can be used by an attacker even after the user has been deleted or the password has been changed. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 , https://github.com/apache/inlong/pull/7884 https://github.com/apache/inlong/pull/7884 to solve it.