CVE-2023-41314

The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:doris:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:21

Type Values Removed Values Added
References () https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4 - Mailing List, Vendor Advisory () https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4 - Mailing List, Vendor Advisory

22 Dec 2023, 17:19

Type Values Removed Values Added
References () https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4 - () https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4 - Mailing List, Vendor Advisory
CPE cpe:2.3:a:apache:doris:*:*:*:*:*:*:*:*
First Time Apache doris
Apache
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.2

18 Dec 2023, 14:05

Type Values Removed Values Added
New CVE

Information

Published : 2023-12-18 09:15

Updated : 2024-11-21 08:21


NVD link : CVE-2023-41314

Mitre link : CVE-2023-41314

CVE.ORG link : CVE-2023-41314


JSON object : View

Products Affected

apache

  • doris
CWE
CWE-863

Incorrect Authorization