CRITICAL🇵🇱 Wersja polska

CVE-2024-36268

CVSS 9.8v3.1pub. 2024-08-02upd. 2024-11-21

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong. This issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick [1] to solve it. [1]  https://github.com/apache/inlong/pull/10251

🤖 AI Analysis
How it works

The vulnerability is caused by improper control of code generation (CWE-94 — Improper Control of Generation of Code), which enables injection of malicious code executed by the server. The vulnerability is remotely accessible over the network without requiring an account or user interaction. The attack does not require special prerequisites (low complexity), making it easy to execute.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely on the server, which may lead to complete system compromise, data breach, and violation of service integrity and availability.

Mitigation & patch

Apache InLong should be updated to version 1.13.0. Alternatively, it is possible to selectively apply a patch (cherry-pick) from the GitHub repository: https://github.com/apache/inlong/pull/10251.

Who is affected

Apache InLong in versions 1.10.0 to 1.12.0 inclusive.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Inlong

    APP
    Apache
    1.10.0 – 1.13.0 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2026-63039CRITICAL9.8same product

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache I...

CVE-2026-63038CRITICAL9.8same product

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache I...

CVE-2026-63037CRITICAL9.8same product

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache I...

CVE-2025-27531CRITICAL9.8PL ✓same product

Apache InLong: deserializacja danych — odczyt dowolnych plików

CVE-2025-27528CRITICAL9.1PL ✓same product

Niebezpieczna deserializacja w Apache InLong umożliwia odczyt plików