CVE-2018-11798: apache software foundation apache thrift
CVSS: 6.5v3.0MediumModified
AliasesDEBIAN-CVE-2018-11798CGA-225x-569w-fw45CGA-282j-7jjh-44c6CGA-2993-6h52-hg45CGA-2rfw-wfjq-ppwvCGA-2v7w-p57q-x53cCGA-2wxc-8wf4-gf89CGA-2x9c-4r53-3jh6CGA-3284-x7p5-7xj4CGA-3529-755p-82qjCGA-3mc4-j763-42pjCGA-3pmf-m2xc-6xqxCGA-3wpr-86q8-h6mgCGA-3wxf-8p9j-3h8wCGA-4497-jp3f-rjrmCGA-4735-8mfc-r4w7CGA-49vj-ph98-mp63CGA-4f5q-923h-pm44CGA-4f85-8m6g-8vc4CGA-4gw5-g7w4-686hCGA-4mpr-px3r-pxpvCGA-4rgj-fm6j-mx9jCGA-4v6w-6r9m-2gfhCGA-527v-6fvf-5q86CGA-55xr-4fjr-mg89CGA-57v5-6v98-2cp7CGA-58m9-h6hh-q84rCGA-5fc9-fh33-x2f9CGA-5rc2-vmjh-96wxCGA-5wv5-x4c2-qjg8CGA-6359-39p7-9xxgCGA-637g-428x-9m6pCGA-63w7-g2xw-c6pxCGA-68jr-7ggf-x9qwCGA-6gmw-ppmm-j52cCGA-6h3m-rr8v-g96hCGA-6hxj-gxxc-8gh7CGA-6jjg-9j7x-9fwxCGA-6jmq-7cmv-5c35CGA-6vqx-c694-4pf7CGA-6wj2-7jm7-5p84CGA-6xmg-xfmx-x3hfCGA-73j7-25w6-fx4mCGA-74j8-47j2-j2cvCGA-74vh-3w8p-q6xpCGA-768g-44mj-wqfpCGA-7c2x-4393-7x85CGA-846x-fhrw-vx6gCGA-848m-m4mv-gwj3CGA-85qr-f9pp-vfqfCGA-87m9-645m-3h4jCGA-89w9-8jj8-x7f3CGA-8jgc-m4j2-w6rrCGA-8v52-f99m-fgh3CGA-8wr7-96f9-m2v6CGA-98j8-wv9f-2qc4CGA-9c5w-2xp7-wwggCGA-9hg8-9gvr-248qCGA-c376-9r9r-99rjCGA-c7j7-rmrx-25rpCGA-cc36-pq66-fqvrCGA-cg8f-9wrx-r6mcCGA-cghc-fp3c-wcg5CGA-cq2j-9c4g-6gg3CGA-f4hc-gv5h-35h6CGA-fg56-7v7r-x2rwCGA-fgg9-mrxx-cm7vCGA-fgp7-q9q9-p87cCGA-fv75-qcr7-j24pCGA-fwh3-fr38-m97fCGA-g6p9-g8qh-3x26CGA-g6x8-6gj2-93vmCGA-g9q5-cp8r-3rppCGA-gfg3-33h8-vv3qCGA-ghm9-vpgx-pr3wCGA-h23g-v753-vmxjCGA-h2cp-r65w-39v5CGA-h9jw-r8wg-42qrCGA-hg6q-j9mf-j423CGA-hj2h-jc8f-4qx4CGA-hpf9-qggm-78wfCGA-j3q4-4m28-7cxfCGA-j432-65gg-vm4jCGA-j5jq-pr2j-rhffCGA-j647-xc22-v5h4CGA-jgv8-7cj4-c34gCGA-jw6w-6qwc-5r3gCGA-jwc8-vhqj-frg3CGA-jwr3-h29g-4jgmCGA-jxpq-jqpr-cc6cCGA-m82c-mm3c-cm2fCGA-mr47-84gm-rc4wCGA-mw4g-4q6f-c46gCGA-p8qf-cgrp-vghrCGA-pc4f-399g-6vfgCGA-pf9h-gwgr-fw5gCGA-pfpr-g498-vg82CGA-pj9m-c5xh-rhp4CGA-q35w-8w9m-954xCGA-qx96-j7pq-q2rpCGA-qxc3-wg3g-3mmxCGA-qxf8-gc99-6pgvCGA-r4fp-fw77-m5pqCGA-rcpg-q67f-jprpCGA-rhwh-jvhj-mqgmCGA-rpvv-2xrg-q3m8CGA-v3c8-74gx-gm3jCGA-v78x-47mx-gfqvCGA-vcwv-rgm5-cf2xCGA-vhc5-2p6p-95j7CGA-vj2f-3rfm-w6c2CGA-vm6q-7jcp-x39gCGA-vp4c-x537-wvgqCGA-vqq9-237x-p7xxCGA-vxx5-7mf5-2hq9CGA-wg63-ccf3-h265CGA-wq5c-qxmq-5fqhCGA-x46v-g6pf-cgprCGA-x56r-g8c8-5cf5CGA-x57q-fxw2-q6f9CGA-xhmq-2jqm-mc6pCGA-xmwr-xp2q-8hqvCGA-xvvj-q74g-7ch8CGA-3xpx-f5j9-27vhCGA-7282-4mwc-48qvCGA-7w4w-4rpw-66h2CGA-95m7-xpfv-crrmCGA-gv97-7558-g27gCGA-hpg6-cchw-hrjqCGA-j7q9-4f86-x5whCGA-m9m5-hhp3-4h38GHSA-vx85-mj8c-4qm6
Published 07-01-2019Last modified 05-08-2024
Vulnerability summary
CVE-2018-11798 is a medium (CVSS 6.5) vulnerability in apache software foundation apache thrift. EPSS estimates a 4.92% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.0 (NVD)EPSS score
4.92%
0%100%
Low · +0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 07-01-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSourcesAll 5 agree
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · MavenEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
4.92%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
+0.04 pp
From 4.88% on 18-09-2026
18-09-202618-10-2026
EPSS score4.92%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard62 products
- automqAll versions (No fix recorded)
- automq-fips< 1.7.4-r1 | All versions (No fix recorded)
- druidAll versions (No fix recorded) | < 35.0.1-r1
- trino< 440-r0
- trino-config< 440-r0
Wolfi60 products
- druidAll versions (No fix recorded) | < 35.0.1-r1
- trino< 440-r0
- trino-config< 440-r0
- trino-oci-entrypoint< 440-r0
- trino-plugin-ai-functions< 440-r0
Apache1 product
- thrift≥ 0.9.2, ≤ 0.11.0
Apache software foundation1 product
- apache thriftApache Thrift 0.9.2 to 0.11.0
Debian1 product
- thrift< 0.11.0-4
Org.apache.thrift1 product
- libthrift≥ 0.9.2, < 0.12.0
6 vendors · 126 products
