CVE-2019-0202CWE-200

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm

published July 25, 2019

CVSS
—
EPSS
2%
Percentile
81.0
In the wild
Unconfirmed
What it is

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02043 · 81.0th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2019-07-25T23:17Z
EPSS history
Timeline
  • 25 JUL 23:17Z
    The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm
    cvelistv5