CVE-2023-43667: Apache InLong: Log Injection in Global functions

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-16 · updated 2026-06-17
Weakness: CWE-74

Description

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log records, making it harder to audit and trace malicious activities. Users are advised to upgrade to Apache InLong's 1.9.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/8628

Affected products

Apache Software Foundation Apache InLong: from 1.4.0 through 1.8.0

References

https://lists.apache.org/thread/spnb378g268p1f902fr9kqyph2k8n543
https://lists.apache.org/thread/spnb378g268p1f902fr9kqyph2k8n543

Get alerted when CVE-2023-43667 or the next vulnerability affects your stack