High severity · published Sep 20, 2022
CVE-2022-40955
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL…
8.8
CVSS
2.7%
EPSS
No
On KEV
Description
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Inlong · Apache
before 1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-40955
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-40955
Mailing List
http://www.openwall.com/lists/oss-security/2022/09/22/5
Issue Tracking
https://lists.apache.org/thread/r1r34y7bchrpmp9jhfdoohzdmk7pj1q1
More from Inlong
9.8
CVE-2026-63039
Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService
9.8
CVE-2026-63038
Apache InLong: SQL Injection via String Concatenation Vulnerability Report
9.8
CVE-2026-63037
Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint
9.8
CVE-2025-27531
Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an authenticated attacker…
9.8
CVE-2024-36268
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong