CVE-2023-51785: 
Java vulnerability analysis and mitigation

A Deserialization of Untrusted Data vulnerability was discovered in Apache InLong, identified as CVE-2023-51785. The vulnerability affects Apache InLong versions from 1.7.0 through 1.9.0. This security flaw was disclosed on January 3, 2024, and allows attackers to perform arbitrary file read attacks using the MySQL driver (OSS Security, Apache Advisory).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and has received a CVSS v3.1 base score of 7.5 (HIGH), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This scoring indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can result in high confidentiality impact (NVD).

The vulnerability enables attackers to perform arbitrary file read operations through the MySQL driver, potentially exposing sensitive system files and configurations. The high confidentiality impact rating suggests that successful exploitation could lead to unauthorized access to protected information (Security Online).

Users are strongly advised to upgrade to Apache InLong version 1.10.0, which contains the fix for this vulnerability. Alternatively, users can apply a cherry-pick solution from the provided pull request if immediate upgrading is not possible (OSS Security).