BaseFortify

Publication date: 2025-11-05

Last updated on: 2025-11-12

Assigner: Apache Software Foundation

Description

An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized modifications. Recommended action for operators: Upgrade to version 0.6.0 as soon as possible (this release contains the fix).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-05

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-05

EPSS Evaluated

2026-07-05

NVD

CVE-2025-58337

Affected Vendors & Products

Vendor	Product	Version / Range
apache	doris_mcp_server	to 0.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-NVD-CWE-noinfo

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker who has a valid read-only account on the Doris MCP Server to bypass the intended read-only restrictions. Due to improper access control, the attacker can make modifications that should normally be prevented by the read-only mode.

Impact Analysis

The vulnerability can impact you by allowing attackers with only read-only access to perform unauthorized modifications on the Doris MCP Server. This could lead to data integrity issues or unauthorized changes that compromise the system's intended security controls.

Mitigation Strategies

Upgrade to version 0.6.0 of Doris MCP Server as soon as possible, as this release contains the fix for the vulnerability.

Hi! I’m here to help you understand CVE-2025-58337. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70