CVE-2023-43668
Published: 16 October 2023
Summary
CVE-2023-43668 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Apache Inlong. Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 17.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-43668 is an Authorization Bypass Through User-Controlled Key vulnerability (CWE-639) affecting Apache InLong versions 1.4.0 through 1.8.0. The flaw allows certain sensitive parameter checks, including those for "autoDeserialize" and "allowLoadLocalInfile", to be bypassed when keys are supplied by the user.
An unauthenticated remote attacker can supply crafted keys to evade authorization controls, potentially achieving full compromise of confidentiality, integrity, and availability on the affected InLong instance. The vulnerability carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without credentials or user interaction.
Apache advisories recommend upgrading to version 1.9.0 or applying the fix from pull request 8604 to restore proper validation of the affected parameters.
EPSS for this CVE rose from a low baseline to a peak of 0.0518 on 2025-01-22 before receding to the current value of 0.0006, indicating a period of increased exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2805
Vulnerability details
Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive params checks will be bypassed, like "autoDeserizalize","allowLoadLocalInfile".... . Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to…
more
solve it. [1] https://github.com/apache/inlong/pull/8604
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.