CVE-2023-41314

HIGH

Apache Doris < 2.0.3 - Unauthenticated Arbitrary File Read and Denial of Service via Snapshot and Log File API

Title source: llm

Description

The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues.

References (1)

Core 1

Core References

Mailing List, Vendor Advisory vendor-advisory

https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4

Scores

CVSS v3 8.2

EPSS 0.0038

EPSS Percentile 59.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-863

Status published

Products (1)

apache/doris < 2.0.3

Published Dec 18, 2023

Tracked Since Feb 18, 2026