Apache Doris
Monthly
Unauthenticated remote attackers can reach internal Apache Doris Frontend (FE) metadata service endpoints in affected 2.0.x through 4.1.x releases and read sensitive cluster information, because those endpoints authenticate callers using client-supplied node information rather than verifying the requesting party (CWE-287, header trust). Exploitation is gated by deployment: it only succeeds 'under certain network configurations' where the FE meta interfaces are reachable by the attacker, so clusters with the FE meta service kept off attacker-reachable networks are not exposed. The vulnerability is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality-only impact - no integrity or availability effect - and no public exploit has been identified at time of analysis; there is no CISA KEV listing. Vendor-released patches exist in Apache Doris 4.0.8 and 4.1.4.
Remote code execution on the Apache Doris Frontend (FE) is achievable when a privileged, already-authenticated user supplies a crafted JDBC driver URL that the FE loads without sufficient validation, a case of inclusion of functionality from an untrusted control sphere (CWE-829). The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) shows the flaw is network-reachable but gated behind high privileges, meaning only accounts that can define or modify JDBC catalogs or external resources can reach the vulnerable code path; anonymous or low-privilege actors are out of scope, and no user interaction or default-configuration vector exists for an external unauthenticated attacker. No CVSS score, EPSS value, KEV entry, or proof-of-concept was supplied in the source data, so there is no confirmation of active exploitation and no public exploit identified at time of analysis, leaving quantitative prioritization signals absent.
Unauthenticated remote attackers can reach internal Apache Doris Frontend (FE) metadata service endpoints in affected 2.0.x through 4.1.x releases and read sensitive cluster information, because those endpoints authenticate callers using client-supplied node information rather than verifying the requesting party (CWE-287, header trust). Exploitation is gated by deployment: it only succeeds 'under certain network configurations' where the FE meta interfaces are reachable by the attacker, so clusters with the FE meta service kept off attacker-reachable networks are not exposed. The vulnerability is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality-only impact - no integrity or availability effect - and no public exploit has been identified at time of analysis; there is no CISA KEV listing. Vendor-released patches exist in Apache Doris 4.0.8 and 4.1.4.
Remote code execution on the Apache Doris Frontend (FE) is achievable when a privileged, already-authenticated user supplies a crafted JDBC driver URL that the FE loads without sufficient validation, a case of inclusion of functionality from an untrusted control sphere (CWE-829). The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) shows the flaw is network-reachable but gated behind high privileges, meaning only accounts that can define or modify JDBC catalogs or external resources can reach the vulnerable code path; anonymous or low-privilege actors are out of scope, and no user interaction or default-configuration vector exists for an external unauthenticated attacker. No CVSS score, EPSS value, KEV entry, or proof-of-concept was supplied in the source data, so there is no confirmation of active exploitation and no public exploit identified at time of analysis, leaving quantitative prioritization signals absent.