Approved changes feed: RSS · Atom
cpe:2.3:a:apache:doris:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Doris (b640ff80-80d3-50b2-bbee-290b80707b54) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/apache/incubator-doris |
purl2cpe | 2026-06-01 10:14:29.044120 |
pkg:sourceforge/apache-doris.mirror |
purl2cpe | 2026-06-01 10:14:29.044122 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-48019 |
vulnerable | 2026-06-08 06:48:13.539117 |
Apache Doris: allows admin users to read arbitrary files through the REST API
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Doris.
Application administrators can read arbitrary
files from the server filesystem through path traversal.
Users are recommended to upgrade to version 2.1.8, 3.0.3 or later, which fixes the issue.
Published: 2025-02-04T18:19:52.467Z
Updated: 2025-02-07T21:20:37.526Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27438 |
vulnerable | 2026-06-08 06:31:28.863039 |
Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution
Download of Code Without Integrity Check vulnerability in Apache Doris.
The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution.
Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code snippet. This code snippet will be run when catalog is initializing without any check.
This issue affects Apache Doris: from 1.2.0 through 2.0.4.
Users are recommended to upgrade to version 2.0.5 or 2.1.x, which fixes the issue.
Published: 2024-03-21T09:39:21.894Z
Updated: 2025-02-13T17:46:29.362Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-26307 |
vulnerable | 2026-06-08 06:31:26.323037 |
Apache Doris: Possible race condition
Possible race condition vulnerability in Apache Doris.
Some of code using `chmod()` method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file.
This could theoretically happen, but the impact would be minimal.
This issue affects Apache Doris: before 1.2.8, before 2.0.4.
Users are recommended to upgrade to version 2.0.4, which fixes the issue.
Published: 2024-03-21T09:38:19.368Z
Updated: 2025-02-13T17:41:13.412Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41314 |
vulnerable | 2026-06-08 06:11:05.919174 |
Apache Doris: Missing API authentication allowed DoS
The api /api/snapshot and /api/get_log_file would allow unauthenticated access.
It could allow a DoS attack or get arbitrary files from FE node.
Please upgrade to 2.0.3 to fix these issues.
Published: 2023-12-18T08:27:51.999Z
Updated: 2024-11-20T18:11:21.234Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41313 |
vulnerable | 2026-06-08 06:11:05.917536 |
Apache Doris: Timing Attack weakness
The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks.
Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue.
Published: 2024-03-12T10:16:23.638Z
Updated: 2025-02-13T17:09:00.819Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23942 |
vulnerable | 2026-06-08 05:40:59.367966 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.