Vulnerability · Published Dec 18, 2023 · Assigned by apache
CVE-2023-41314Apache Doris: Missing API authentication allowed DoS
High 8.2
In plain English
A high-severity incorrect authorization in Apache Doris from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS NVD)8.2High
Exploit odds (30 days)0.9%top 40.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Doris | 1.2.0 – through 2.0.3 |
Weakness: CWE-863
References
- https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4 vendor-advisory