{"id":"CVE-2023-31064","aliases":["EUVD-2023-1940","GHSA-3p9p-59qf-mqwh"],"status":"published","title":"Apache InLong: Insecurity direct object references cancelling applications","description":"Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. the user in InLong could cancel an application that doesn't belongs to it. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick  https://github.com/apache/inlong/pull/7799 https://github.com/apache/inlong/pull/7799  to solve it.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01247,"percentile":0.69569,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-552"],"published":"2023-05-22T15:44:22Z","modified":"2026-06-17T05:56:12Z","fixes":[{"ecosystem":"Maven","package":"org.apache.inlong:manager-workflow","fixed_in":["1.7.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.inlong:manager-workflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.7.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.inlong:manager-workflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.7.0"}]}],"versions":["1.2.0-incubating","1.3.0","1.4.0","1.5.0","1.6.0"]}],"products":[{"vendor":"apache","product":"inlong"},{"vendor":"apache software foundation","product":"apache inlong"}],"references":[{"url":"https://lists.apache.org/thread/1osd2k3t3qol2wdsswqtr9gxdkf78n00","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31064","tags":["advisory"]},{"url":"https://github.com/apache/inlong/pull/7799","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3p9p-59qf-mqwh"},{"url":"https://github.com/apache/inlong","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-31064","title":"Apache InLong: Insecurity direct object references cancelling applications","description":"Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. the user in InLong could cancel an application that doesn't belongs to it. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick  https://github.com/apache/inlong/pull/7799 https://github.com/apache/inlong/pull/7799  to solve it.\n\n\n","status":"published","published":"2023-05-22T15:44:22.343Z","modified":"2024-10-09T19:53:56.81Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:35:27.810438Z"}],"euvd":[{"id":"EUVD-2023-1940","description":"Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. the user in InLong could cancel an application that doesn't belongs to it. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick  https://github.com/apache/inlong/pull/7799 https://github.com/apache/inlong/pull/7799  to solve it.\n\n\n","status":"published","published":"2023-05-22T15:44:22Z","modified":"2024-10-09T19:53:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:27:42.546269Z"}],"ghsa":[{"id":"GHSA-3p9p-59qf-mqwh","title":"Apache InLong has Files or Directories Accessible to External Parties","description":"Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong from 1.2.0 through 1.6.0.The user in InLong could cancel an application that doesn't belong to it. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7799 to solve it.\n\n\n","status":"published","published":"2023-07-06T21:14:59Z","modified":"2023-11-10T05:02:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:37:18.40412Z"}],"nvd":[{"id":"CVE-2023-31064","description":"Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. the user in InLong could cancel an application that doesn't belongs to it. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick  https://github.com/apache/inlong/pull/7799 https://github.com/apache/inlong/pull/7799  to solve it.\n\n\n","status":"published","published":"2023-05-22T16:15:09.963Z","modified":"2026-06-17T05:56:12.367Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:08:03.200773Z"}],"osv":[{"id":"GHSA-3p9p-59qf-mqwh","title":"Apache InLong has Files or Directories Accessible to External Parties","description":"Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong from 1.2.0 through 1.6.0.The user in InLong could cancel an application that doesn't belong to it. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7799 to solve it.\n\n\n","status":"published","published":"2023-07-06T21:14:59Z","modified":"2024-02-16T08:17:30.822842Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T15:46:36.092962Z"}]}}