CVE-2023-41314 Apache Doris: Missing API authentication allowed DoS
Unauthenticated access to specific APIs in Apache Doris allows attackers to cause denial of service or read arbitrary files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41314?
CVE-2023-41314 is a high-severity missing authorization vulnerability in Apache Doris, published on 18 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues.
Weakness: CWE-863
Which versions are affected by CVE-2023-41314?
It affects 1 product.
Products include Apache Doris.
How do I fix CVE-2023-41314?
No fix has been published for CVE-2023-41314 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-41314 being exploited?
There is no known exploitation of CVE-2023-41314 in the wild and no public exploit code.
Other vulnerabilities in Apache Doris
- CVE-2024-27438 Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution
- CVE-2023-41313 Apache Doris: Timing Attack weakness
- CVE-2026-58319 Apache Doris: Improper Authentication in Frontend HTTP API
- CVE-2022-23942 Apache Doris hardcoded cryptography initialization
- CVE-2024-48019 Apache Doris: allows admin users to read arbitrary files through the REST API
Sources
Also known as GHSA-vm9x-85qm-fvq3.