CVE-2019-0202: Infoleak
The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-0202?
CVE-2019-0202 is a vulnerability in Apache Storm Logviewer daemon that allows unauthorized access to files on the host's file system.
How does CVE-2019-0202 affect Apache Storm?
CVE-2019-0202 affects Apache Storm versions 0.9.1-incubating to 1.2.2.
What is the severity of CVE-2019-0202?
CVE-2019-0202 has a severity rating of 7.5 (high).
How can an attacker exploit CVE-2019-0202?
An attacker can exploit CVE-2019-0202 by leveraging the exposed HTTP-accessible endpoints of the Logviewer daemon to read/search log files on the host system, including files not intended to be accessible.
What is the recommended fix for CVE-2019-0202?
To fix CVE-2019-0202, it is recommended to upgrade Apache Storm to a version later than 1.2.2 or apply the necessary patches provided by Apache.