Cyber Resilience

CVE-2023-31454

High

Published: 22 May 2023

Published
22 May 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0061 70.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-31454 is a high-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Apache Inlong. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 29.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade…

more

to Apache InLong's 1.7.0 or cherry-pick [1] to solve it.[1] https://github.com/apache/inlong/pull/7947 https://github.com/apache/inlong/pull/7947

CWE(s)
CWE-732

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

apache
inlong
1.2.0 — 1.6.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures
addresses: CWE-732

Procedures support proper permission assignment for critical resources through documented controls.

AC-16 Security and Privacy Attributes
addresses: CWE-732

Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels.

AC-6 Least Privilege
addresses: CWE-732

Prevents overly permissive assignments to critical resources by limiting to task needs.

AT-1 Policy and Procedures
addresses: CWE-732

Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources.

AT-3 Role-based Training
addresses: CWE-732

Training on permission management reduces incorrect permission assignments for critical resources.

AU-9 Protection of Audit Information
addresses: CWE-732

Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.

CA-2 Control Assessments
addresses: CWE-732

Assessments review permission assignments on critical resources to confirm correctness, mitigating exploitation via incorrect permissions.

CA-4 Security Certification
addresses: CWE-732

Certification includes checking that permissions on critical resources are correctly assigned.

References