CVE-2023-41314
Assigner: apache
Published: 2023-12-18T08:27:51.999Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Doris
vendor: Apache Software Foundation
versions: lessThanOrEqual: 2.0.3
status: affected
version: 1.2.0
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: The api /api/snapshot and /api/get_log_file would allow unauthenticated access.<br>It could allow a&nbsp;DoS attack or get arbitrary files from FE node.<br>Please&nbsp;upgrade to 2.0.3 to fix these issues.
value: The api /api/snapshot and /api/get_log_file would allow unauthenticated access.
It could allow a DoS attack or get arbitrary files from FE node.
Please upgrade to 2.0.3 to fix these issues.
metrics: other: content: text: important
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-863
description: CWE-863 Incorrect Authorization
type: CWE
source: discovery: UNKNOWN
title: Apache Doris: Missing API authentication allowed DoS
x_generator: engine: Vulnogram 0.1.0-dev