CVE-2023-41314CWE-863

Apache Doris: Missing API authentication allowed DoS

published December 18, 2023

CVSS
—
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

The api /api/snapshot and /api/get_log_file would allow unauthenticated access.

It could allow a DoS attack or get arbitrary files from FE node.

Please upgrade to 2.0.3 to fix these issues.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00898 · 59.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-12-18T08:27Z
EPSS history
Timeline
  • 18 DEC 08:27Z
    Apache Doris: Missing API authentication allowed DoS
    cvelistv5