CVE-2023-41314

The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues.
References
Link Resource
https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4 Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:doris:*:*:*:*:*:*:*:*

History

22 Dec 2023, 17:19

Type Values Removed Values Added
CPE cpe:2.3:a:apache:doris:*:*:*:*:*:*:*:*
References () https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4 - () https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4 - Mailing List, Vendor Advisory
First Time Apache doris
Apache
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.2

18 Dec 2023, 14:05

Type Values Removed Values Added
New CVE

Information

Published : 2023-12-18 09:15

Updated : 2024-02-28 20:54


NVD link : CVE-2023-41314

Mitre link : CVE-2023-41314

CVE.ORG link : CVE-2023-41314


JSON object : View

Products Affected

apache

  • doris
CWE
CWE-863

Incorrect Authorization