CVE-2023-31098: 
Java vulnerability analysis and mitigation

A Weak Password Requirements vulnerability was identified in Apache InLong versions 1.1.0 through 1.6.0. The vulnerability allows users to change their passwords to simple combinations of characters or symbols, making them susceptible to easy guessing by attackers (NIST NVD).

The vulnerability is tracked as CVE-2023-31098 and has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness is categorized under CWE-521 (Weak Password Requirements), indicating insufficient password complexity enforcement in the system (NIST NVD).

The vulnerability could allow attackers to easily guess user passwords and gain unauthorized access to accounts, potentially leading to complete system compromise given the critical CVSS score. The high impact scores in confidentiality, integrity, and availability (C:H/I:H/A:H) indicate severe potential consequences if exploited (NIST NVD).

Users are advised to upgrade to Apache InLong version 1.7.0 or apply the fix by cherry-picking the patch from https://github.com/apache/inlong/pull/7805 (NIST NVD).