Not rated
CVE-2022-40955 In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL…
Description
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache InLong 1.3 | earliest → < 1.3.0 | 1.3.0 |
References
- lists.apache.org lists.apache.org
- [oss-security] 20220922 CVE-2022-40955: Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache InLong
The 41 CVEs of Apache InLong →
CVE-2026-63046
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent…
Not rated
CVE-2026-63044
Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required)…
Not rated
CVE-2026-63043
Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem
Not rated
CVE-2026-63042
Files or Directories Accessible to External Parties vulnerability in Apache InLong
Not rated