CVE-2018-14672

2019-08-1517:54:05

yandex

www.cve.org

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

40.6%

JSON

In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.

CNA Affected

[
  {
    "product": "ClickHouse",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to version 18.12.13."
      }
    ]
  }
]

References

clickhouse.yandex/docs/en/security_changelog/