PT-2025-45743 · Pypi · Doris Mcp Server

Publicado 2025-11-05 · Atualizado 2025-11-05

OSV

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions.

Impact:

Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications.

Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix).

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

GHSA-M35W-XX8C-6XC7

Produtos afetados

Doris Mcp Server

Referências · 7

• https://github.com/apache/doris-mcp-server · Nota
• https://github.com/apache/doris-mcp-server/commit/5923cc1c8973069a6d54eca1948a10488cbf409e · Nota
• https://lists.apache.org/thread/6tswlphj0pqn9zf25594r3c1vzvfj40h · Nota
• http://openwall.com/lists/oss-security/2025/11/04/5 · Nota
• https://security.snyk.io/vuln/SNYK-PYTHON-DORISMCPSERVER-13835132 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-58337 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-m35w-xx8c-6xc7 · Aviso do Fabricante