Cyber Resilience

CVE-2023-31101

Medium

Published: 22 May 2023

Published
22 May 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0053 67.4th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-31101 is a medium-severity Initialization of a Resource with an Insecure Default (CWE-1188) vulnerability in Apache Inlong. Its CVSS base score is 6.5 (Medium).

Operationally, ranked in the top 32.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0. Users registered in InLong who joined later can see deleted users' data. Users are advised to upgrade to Apache InLong's…

more

1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 to solve it.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

apache
inlong
1.5.0, 1.6.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-1188

Requires documented secure initialization practices and avoidance of insecure defaults in configuration baselines.

addresses: CWE-1188

Reviewing and updating baseline when components are installed or upgraded prevents initialization with insecure defaults.

addresses: CWE-1188

Requiring explicit configuration to minimal functionality overrides insecure defaults that would otherwise enable excess capabilities.

addresses: CWE-1188

Tailoring replaces or augments insecure default initializations with system-specific values and compensating controls before deployment.

addresses: CWE-1188

Central configuration overrides or replaces insecure default initializations that would otherwise be left unchanged on each system.

addresses: CWE-1188

SCRM practices during acquisition and configuration management address insecure default initializations shipped by vendors.

addresses: CWE-1188

Scans detect resources initialized with insecure defaults that create exploitable conditions.

addresses: CWE-1188

Instruction on secure initialization of security controls prevents leaving resources with insecure defaults after installation.

References