CVE-2023-31453 Apache InLong: IDOR make users can delete others' subscription
Attackers can delete other users' subscriptions due to incorrect permission checks in Apache InLong.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-31453?
CVE-2023-31453 is a high-severity missing authorization vulnerability in Apache InLong, published on 22 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the deleted subscription. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick [1] to solve it.
[1]
https://github.com/apache/inlong/pull/7949 https://github.com/apache/inlong/pull/7949
Weakness: CWE-732
Which versions are affected by CVE-2023-31453?
4 open source packages ship an affected version, including org.apache.inlong:manager-service and org.apache.inlong:manager-web. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.inlong:manager-service Maven | From 1.2.0 | 1.7.0 |
org.apache.inlong:manager-service Maven | From 1.2.0 | 1.7.0 |
org.apache.inlong:manager-web Maven | From 1.2.0 | 1.7.0 |
org.apache.inlong:manager-web Maven | From 1.2.0 | 1.7.0 |
Products include Apache Inlong.
How do I fix CVE-2023-31453?
Upgrade org.apache.inlong:manager-service to 1.7.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-31453 being exploited?
There is no known exploitation of CVE-2023-31453 in the wild and no public exploit code.
Other vulnerabilities in Apache InLong
- CVE-2026-63037 Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint
- CVE-2026-63038 Apache InLong: SQL Injection via String Concatenation Vulnerability Report
- CVE-2026-63039 Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService
- CVE-2025-27531 Apache InLong: An arbitrary file read vulnerability for JDBC
- CVE-2024-26579 Apache Inlong JDBC Vulnerability
Sources
Also known as GHSA-8rjh-3mhm-966q.