CVE-2025-27528

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows attackers to bypass the security mechanisms of InLong JDBC and leads to arbitrary file reading. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/11747

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/apache/inlong/pull/11747	Issue Tracking
https://lists.apache.org/thread/b807rqzgyv4qgvxw3nhkq8tl6g90gqgj	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/05/28/3	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-05-28 08:15

Updated : 2025-06-03 15:36

NVD link : CVE-2025-27528

Mitre link : CVE-2025-27528

CVE.ORG link : CVE-2025-27528

JSON object : View

Products Affected

apache

inlong

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-27528", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2025-05-28T08:15:21.830", "references": [{"url": "https://github.com/apache/inlong/pull/11747", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://lists.apache.org/thread/b807rqzgyv4qgvxw3nhkq8tl6g90gqgj", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2025/05/28/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in Apache InLong.\n\nThis issue affects Apache InLong: from 1.13.0 through 2.1.0. \n\nThis\nvulnerability allows attackers to bypass the security mechanisms of InLong\nJDBC and leads to arbitrary file reading.\u00a0Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick [1] to solve it.\n\n[1] https://github.com/apache/inlong/pull/11747"}, {"lang": "es", "value": "Vulnerabilidad de deserializaci\u00f3n de datos no confiables en Apache InLong. Este problema afecta a Apache InLong desde la versi\u00f3n 1.13.0 hasta la 2.1.0. Esta vulnerabilidad permite a los atacantes eludir los mecanismos de seguridad de InLong JDBC y permite la lectura arbitraria de archivos. Se recomienda a los usuarios actualizar a la versi\u00f3n 2.2.0 de Apache InLong o seleccionar cuidadosamente [1] para solucionarlo. [1] https://github.com/apache/inlong/pull/11747"}], "lastModified": "2025-06-03T15:36:47.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBE3933A-B8FF-4352-817C-AA8F96DB4434", "versionEndExcluding": "2.2.0", "versionStartIncluding": "1.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}