QwikSec

Security Database

CVE

CWE

Training

CVE-2019-0202

Published: Jul 25, 2019

Modified: Aug 4, 2024

PUBLISHED

Description

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints.

Vendor	Product	Versions
Apache	Storm	affected `0.9.1-incubating to 1.2.2`

Weaknesses (CWE)

References

[storm-user] 20190724 [CVE-2019-0202] Apache Storm Logviewer file system access vulnerability

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.