VulnerabilityAnalyzed

CVE-2024-48019

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Doris.

MEDIUM 5.4EPSS 1.04%

Does this matter?

Lower severity and a low EPSS score (1.04%). Track it; it rarely justifies an emergency change on its own.

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Doris. Application administrators can read arbitrary files from the server filesystem through path traversal. Users are recommended to upgrade to version 2.1.8, 3.0.3 or later, which fixes the issue.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS: 1.04% probability · 62th percentile
CISA KEV: Not listed
Weakness: CWE-22, CWE-552
Affected: apache/doris
Source: security@apache.org

References

https://lists.apache.org/thread/p70klgmyrgknhn0t195261wvwv5jw6hrVendor Advisory
http://www.openwall.com/lists/oss-security/2025/02/04/2Mailing List, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.