CVE-2025-27531

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27531
Deserialization of Untrusted Data vulnerability in Apache InLong.  This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker to read arbitrary files by double writing the param. Users are recommended to upgrade to version 2.1.0, which fixes the issue.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5 Vendor Advisory Mailing List
http://www.openwall.com/lists/oss-security/2025/02/28/2 Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*
History

23 Jun 2025, 14:24

Type Values Removed Values Added
References () https://lists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5 - () https://lists.apache.org/thread/r62lkqrr739wvcb60j6ql6q63rh4bxx5 - Vendor Advisory, Mailing List
References () http://www.openwall.com/lists/oss-security/2025/02/28/2 - () http://www.openwall.com/lists/oss-security/2025/02/28/2 - Mailing List, Vendor Advisory
First Time Apache inlong
Apache
CPE cpe:2.3:a:apache:inlong:*:*:*:*:*:*:*:*

10 Jun 2025, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

09 Jun 2025, 12:15

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de deserialización de datos no confiables en Apache InLong. Este problema afecta a Apache InLong: desde la versión 1.13.0 hasta la 2.1.0, este problema permitía a un atacante autenticado leer archivos arbitrarios mediante la escritura duplicada del parámetro. Se recomienda a los usuarios actualizar a la versión 2.1.0, que soluciona el problema.

06 Jun 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-06 15:15

Updated : 2025-06-23 14:24

NVD link : CVE-2025-27531

Mitre link : CVE-2025-27531

CVE.ORG link : CVE-2025-27531

JSON object : View

Products Affected

apache

  • inlong
CWE
CWE-502

Deserialization of Untrusted Data