-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.inlong:manager-service | maven | >= 1.2.0, < 1.7.0 | 1.7.0 |
| org.apache.inlong:manager-web | maven | >= 1.2.0, < 1.7.0 | 1.7.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks in subscription management operations. The GitHub PR #7949 shows critical changes in InlongConsumeServiceImpl.java where a weak precondition check (existEntity.getInCharges().contains(operator)) was replaced with a dedicated permission validation service (checkUser). This indicates the original update function failed to properly authenticate users before allowing destructive operations, directly enabling the permission bypass described in CVE-2023-31453.