Riskcovery

CVE-2024-48019

Apache Doris: allows admin users to read arbitrary files through the REST API

State
Published
Severity
5.4 Medium
Published
Feb 4, 2025
Updated
Feb 7, 2025
Reserved
Oct 8, 2024

Read the record on cve.org

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Doris.

Application administrators can read arbitrary files from the server filesystem through path traversal.

Users are recommended to upgrade to version 2.1.8, 3.0.3 or later, which fixes the issue.

Scores

CVSSScoreVectorSource
3.15.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NCISA-ADP

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-552 Files or Directories Accessible to External Parties

Affected Products

ProductVersions
Apache DorisApache Software Foundation
  • 2.1.0 to before 2.1.8Affected
  • 3.0.0 to before 3.0.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.