CVE-2024-48019

Name of the Vulnerable Software and Affected Versions: Apache Doris versions prior to 2.1.8 Apache Doris versions prior to 3.0.3

Description: The issue allows application administrators to read arbitrary files from the server filesystem through path traversal, which is a type of vulnerability known as Improper Limitation of a Pathname to a Restricted Directory. This can be exploited through the REST API.

Recommendations: For Apache Doris versions prior to 2.1.8, upgrade to version 2.1.8 or later to fix the issue. For Apache Doris versions prior to 3.0.3, upgrade to version 3.0.3 or later to fix the issue. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation.