CVE-2022-40955

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache InLong	>= Apache InLong, < 1.3.0

References

http://www.openwall.com/lists/oss-security/2022/09/22/5Mailing List, Third Party Advisory
https://lists.apache.org/thread/r1r34y7bchrpmp9jhfdoohzdmk7pj1q1Issue Tracking, Mailing List, Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/09/22/5Mailing List, Third Party Advisory
https://lists.apache.org/thread/r1r34y7bchrpmp9jhfdoohzdmk7pj1q1Issue Tracking, Mailing List, Patch, Vendor Advisory

Timeline

Published: Sep 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-409566.1When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. CVE-2022-409576.5Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only aff CVE-2022-409586.5By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus ov CVE-2022-409596.5During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permission CVE-2022-40966.5Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2.CVE-2022-409606.5Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a potentially exploita CVE-2022-409616.5During startup, a graphics driver with an unexpected name could lead to a stack-buffer overflow causing a potentially exploitable crash.<br>CVE-2022-409628.8Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs CVE-2022-409635.4Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress.CVE-2022-409646.7Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user to potentially enabl CVE-2022-409655.4The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the Pos CVE-2022-409668.8Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass authentication and acce