{"id":"CVE-2023-27296","aliases":["EUVD-2023-1014","GHSA-gpqq-59rp-3c3w"],"status":"published","title":"Apache InLong: JDBC Deserialization Vulnerability in InLong","description":"Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.\n\nIt could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability.\n\nThis issue affects Apache InLong: from 1.1.0 through 1.5.0.  Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it.\n\n\n\n[1]  https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html\n\n https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html \n\n[2]  https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01475,"percentile":0.74021,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2023-03-27T14:10:32Z","modified":"2026-06-17T05:44:44Z","fixes":[{"ecosystem":"Maven","package":"org.apache.inlong:inlong-manager","fixed_in":["1.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.inlong:inlong-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.inlong:inlong-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.6.0"}]}],"versions":["1.1.0-incubating","1.2.0-incubating","1.3.0","1.4.0","1.5.0"]}],"products":[{"vendor":"apache","product":"inlong"},{"vendor":"apache software foundation","product":"apache inlong"}],"references":[{"url":"https://lists.apache.org/thread/xbvtjw9bwzgbo9fp1by8o3p49nf59xzt","tags":["vendor-advisory","x_transferred","Mailing List","Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27296","tags":["advisory"]},{"url":"https://github.com/apache/inlong/pull/7422","tags":["web"]},{"url":"https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gpqq-59rp-3c3w"},{"url":"https://github.com/apache/inlong","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-27296","title":"Apache InLong: JDBC Deserialization Vulnerability in InLong","description":"Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.\n\nIt could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability.\n\nThis issue affects Apache InLong: from 1.1.0 through 1.5.0.  Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it.\n\n\n\n[1]  https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html\n\n https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html \n\n[2]  https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422 \n\n\n\n","status":"published","published":"2023-03-27T14:10:32.785Z","modified":"2024-10-23T16:39:30.822Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:26.261013Z"}],"euvd":[{"id":"EUVD-2023-1014","description":"Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.\n\nIt could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability.\n\nThis issue affects Apache InLong: from 1.1.0 through 1.5.0.  Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it.\n\n\n\n[1]  https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html\n\n https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html \n\n[2]  https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422 \n\n\n\n","status":"published","published":"2023-03-27T14:10:32Z","modified":"2024-10-23T16:39:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:05:21.011532Z"}],"ghsa":[{"id":"GHSA-gpqq-59rp-3c3w","title":"Apache InLong vulnerable to JDBC Deserialization of Untrusted Data","description":"Apache InLong versions from 1.1.0 through 1.5.0 are vulnerable to Java Database Connectivity (JDBC) deserialization of untrusted data from the MySQL JDBC URL in MySQLDataNode. It could be triggered by authenticated users of InLong. This has been patched in version 1.6.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick the [patch](https://github.com/apache/inlong/pull/7422) to solve it.","status":"published","published":"2023-03-27T15:30:16Z","modified":"2023-03-31T16:08:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:49.768564Z"}],"nvd":[{"id":"CVE-2023-27296","description":"Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.\n\nIt could be triggered by authenticated users of InLong, you could refer to [1] to know more about this vulnerability.\n\nThis issue affects Apache InLong: from 1.1.0 through 1.5.0.  Users are advised to upgrade to Apache InLong's latest version or cherry-pick [2] to solve it.\n\n\n\n[1]  https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html\n\n https://programmer.help/blogs/jdbc-deserialization-vulnerability-learning.html \n\n[2]  https://github.com/apache/inlong/pull/7422 https://github.com/apache/inlong/pull/7422 \n\n\n\n","status":"published","published":"2023-03-27T15:15:08.65Z","modified":"2026-06-17T05:44:44.177Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:50.908252Z"}],"osv":[{"id":"GHSA-gpqq-59rp-3c3w","title":"Apache InLong vulnerable to JDBC Deserialization of Untrusted Data","description":"Apache InLong versions from 1.1.0 through 1.5.0 are vulnerable to Java Database Connectivity (JDBC) deserialization of untrusted data from the MySQL JDBC URL in MySQLDataNode. It could be triggered by authenticated users of InLong. This has been patched in version 1.6.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick the [patch](https://github.com/apache/inlong/pull/7422) to solve it.","status":"published","published":"2023-03-27T15:30:16Z","modified":"2023-11-08T04:12:04.051854Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:48.191583Z"}]}}