« Volver al listado

CVE-2025-66336

Estado: AnalizadaAlta (8.1)—

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope.

Affected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

SQL injection (CWE-89) en servicio remoto con PR:L permite acceso no autorizado a metadatos. Lectura de datos (C:H) es el impacto primario; manipulación de datos (I:H) es secundaria si el contexto lo permite.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork Segmentation

Tecnologías afectadas (1)

Apache — Doris MCP Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-66336",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-66336",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-22T15:49:32.488671Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Doris MCP Server",
          "versions": [
            {
              "status": "affected",
              "version": "0.1.0",
              "lessThan": "0.6.1",
              "versionType": "semver"
            }
          ],
          "packageName": "doris-mcp-server",
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-22T08:16:36.390",
  "references": [
    {
      "url": "https://lists.apache.org/thread/4l4v3m7ofwrgp4s4s98pjb5l03fcrzo2",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/06/22/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope.\n\nAffected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue."
    },
    {
      "lang": "es",
      "value": "Apache Doris MCP Server contiene una vulnerabilidad de inyección SQL en una ruta de consulta de metadatos. Un nombre de base de datos controlado por el usuario se interpola directamente en una consulta SQL, y la consulta se ejecuta sin pasar el contexto de autorización del llamante. Esto puede permitir a un atacante autenticado, o a un atacante anónimo si la autenticación está deshabilitada, eludir la validación de seguridad SQL y acceder a metadatos fuera del alcance de la base de datos previsto.\n\nSe recomienda a los usuarios afectados actualizar a la versión 0.6.1 de Doris o posterior, que corrige el problema."
    }
  ],
  "lastModified": "2026-09-30T21:10:00.190",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:doris_mcp_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95766A2C-71CC-4CC7-9F95-501B6ACC1E2F",
              "versionEndExcluding": "0.6.1",
              "versionStartIncluding": "0.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}