CVE-2023-31065
Apache InLong: Insufficient Session Expiration in InLong
Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.
An old session can be used by an attacker even after the user has been deleted or the password has been changed.
Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 , https://github.com/apache/inlong/pull/7884 https://github.com/apache/inlong/pull/7884 to solve it.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.
An old session can be used by an attacker even after the user has been deleted or the password has been changed.
Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 , https://github.com/apache/inlong/pull/7884 https://github.com/apache/inlong/pull/7884 to solve it.
- Record
CVE-2023-31065- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-613
- Updated
- 2026-11-02
CVE List
Apache InLong: Insufficient Session Expiration in InLong
Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.
An old session can be used by an attacker even after the user has been deleted or the password has been changed.
Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 , https://github.com/apache/inlong/pull/7884 https://github.com/apache/inlong/pull/7884 to solve it.
- Record
CVE-2023-31065- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-613
- Updated
- 2026-11-02
EUVDEUVD-2023-1985
Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.
An old session can be used by an attacker even after the user has been deleted or the password has been changed.
Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 , https://github.com/apache/inlong/pull/7884 https://github.com/apache/inlong/pull/7884 to solve it.
- Record
EUVD-2023-1985- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-757p-7hp5-pqmr
Apache InLong Insufficient Session Expiration vulnerability
Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.
An old session can be used by an attacker even after the user has been deleted or the password has been changed.
Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 or https://github.com/apache/inlong/pull/7884 to solve it.
- Record
GHSA-757p-7hp5-pqmr- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-613
- Updated
- 2026-11-02
OSVGHSA-757p-7hp5-pqmr
Apache InLong Insufficient Session Expiration vulnerability
Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0.
An old session can be used by an attacker even after the user has been deleted or the password has been changed.
Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 or https://github.com/apache/inlong/pull/7884 to solve it.
- Record
GHSA-757p-7hp5-pqmr- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-613
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.inlong:manager-pojoMaven |
1.4.0 up to 1.7.0 | 1.7.0 |
org.apache.inlong:manager-daoMaven |
1.4.0 up to 1.7.0 | 1.7.0 |
org.apache.inlong:manager-webMaven |
1.4.0 up to 1.7.0 | 1.7.0 |
org.apache.inlong:manager-serviceMaven |
1.4.0 up to 1.7.0 | 1.7.0 |
org.apache.inlong:manager-pojoMaven |
1.4.0 up to 1.7.0, plus listed versions 1.5.01.6.0 |
1.7.0 |
org.apache.inlong:manager-daoMaven |
1.4.0 up to 1.7.0, plus listed versions 1.5.01.6.0 |
1.7.0 |
org.apache.inlong:manager-webMaven |
1.4.0 up to 1.7.0, plus listed versions 1.5.01.6.0 |
1.7.0 |
org.apache.inlong:manager-serviceMaven |
1.4.0 up to 1.7.0, plus listed versions 1.5.01.6.0 |
1.7.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-31065 is a critical vulnerability (CVSS 9.1) in Apache Inlong, published May 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in org.apache.inlong:manager-pojo 1.7.0.