VDB
CVE-2019-0202
CVE-2019-0202
PUBLISHED
CVSS 7.5 HIGH
Reported by apache · Published July 25, 2019
The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints.
Risk Scores
CVSS 3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Storm | 0.9.1-incubating to 1.2.2 |
| Apache | Storm | *, 0.9.1-incubating to 1.2.2, 0.9.1-incubating to 1.2.2 |
| Maven | org.apache.storm:storm-core | 0.9.1, 0.9.1 |
Timeline
- Jul 25, 2019 CVE Published
- Oct 9, 2019 CVE Updated
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 27, 2021 EPSS Score
- Dec 29, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 4, 2022 EPSS Score
- Jul 6, 2022 EPSS Score
- Sep 8, 2022 EPSS Score