PT-2025-2787 · Apache · Apache Doris

Man Yue Mo · Published 2025-02-04 · Updated 2025-02-07 · CVE-2024-48019

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Apache Doris versions prior to 2.1.8 Apache Doris versions prior to 3.0.3

Description: The issue allows application administrators to read arbitrary files from the server filesystem through path traversal, which is a type of vulnerability known as Improper Limitation of a Pathname to a Restricted Directory. This can be exploited through the REST API.

Recommendations: For Apache Doris versions prior to 2.1.8, upgrade to version 2.1.8 or later to fix the issue. For Apache Doris versions prior to 3.0.3, upgrade to version 3.0.3 or later to fix the issue. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation.

Fix

Path traversal

Files Accessible to External Parties

Weakness Enumeration

CWE-22

CWE-552

Related Identifiers

CVE-2024-48019

Affected Products

Apache Doris

References · 8

• https://lists.apache.org/thread/p70klgmyrgknhn0t195261wvwv5jw6hr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48019 · Security Note
• http://openwall.com/lists/oss-security/2025/02/04/2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48019 · Vendor Advisory
• https://t.me/cvenotify/110485 · Telegram Post
• https://twitter.com/oss_security/status/1886817581652423003 · Twitter Post
• https://t.me/cvedetector/17241 · Telegram Post
• https://twitter.com/CVEnew/status/1886848149261520900 · Twitter Post