CVE-2023-41314

The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues.

Score

CVSS 3.1 8.2 High

Status

Modified - security@apache.org

Published

2023-12-18

Last modified

2024-11-20

Weaknesses

CWE-863

Affected products

• Doris (Apache)
• Apache Doris (Apache Software Foundation)

References

• https://lists.apache.org/thread/tgvpvz3yw7zgodl1sb3sv3jbbz8t5zb4