CVE-2022-23942

CVE-2022-23942: Apache Doris hardcoded cryptography initialization

Vendor Apache Software Foundation

Product Apache Doris(Incubating)

Weakness CWE-798 · Hardcoded credentials

Published April 26, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.

Key dates

02Disclosure timeline

April 26, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-23942 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/798.html AskarLabs — CWE-798 write-up Use of Hard-coded Credentials

Related vulnerabilities

04Related CVE

CVE-2026-27073 WordPress Addi – Cuotas que se adaptan a ti plugin <= 2.0.4 - Broken Authentication vulnerability CVE-2025-58269 WordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure Vulnerability CVE-2025-58656 WordPress Estonian Shipping Methods for WooCommerce Plugin <= 1.7.2 - Sensitive Data Exposure Vulnerability CVE-2024-5810 WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials CVE-2025-8570 BeyondCart Connector <= 3.0.1 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation via determine_current_user Filter