Cloudera vulnerabilities, page 3
51 vulnerabilities
Known vulnerabilities in Cloudera products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 12 products.
MediumCVE-2014-0220cloudera · cloudera_managercloudera cloudera_managerCloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to obtain sensitive configuration information via the API.EPSS1.85%LowCVE-2014-8733cloudera · cloudera_managercloudera cloudera_managerCloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in unspecified world-readable files under /etc/hadoop, which allows local users to obtain this password.EPSS0.32%MediumCVE-2012-2230cloudera · cloudera_manager +1 morecloudera cloudera_managerCloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote authenticated users to impersonate arbitrary user accounts via unspecified vectors, a different vulnerability than CVE-2012-1574.EPSS1.87%MediumCVE-2012-1574apache · hadoop +3 moreapache hadoopThe Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.EPSS4.77%HighCVE-2017-9326cloudera · cloudera_managercloudera cloudera_managerThe keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed by Cloudera Manager. The keystore file itself is not exposed.EPSS0.76%HighCVE-2017-9325cloudera · cdhcloudera cdhThe provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs.EPSS0.83%MediumCVE-2017-9327cloudera · cloudera_managercloudera cloudera_managerSecret data of processes managed by CM is not secured by file permissions.EPSS1.26%HighCVE-2017-7399cloudera · cloudera_managercloudera cloudera_managerCloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users.EPSS0.86%HighCVE-2017-15536cloudera · data_science_workbenchcloudera data_science_workbenchAn issue was discovered in Cloudera Data Science Workbench (CDSW) 1.x before 1.2.0. Several web application vulnerabilities allow malicious authenticated users of CDSW to escalate privileges in CDSW. CDSW users can exploit these vulnerabilities in combination to gain root access to CDSW nodes, gain access to the CDSW database which includes Kerberos keytabs of CDSW users and bcrypt hashed passwords, and gain access to other privileged information such as session tokens, invitation tokens, and environment variables.EPSS0.92%MediumCVE-2019-14449cloudera · cloudera_managercloudera cloudera_managerAn issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this product.EPSS0.52%HighCVE-2019-7319cloudera · cdhcloudera cdhAn issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, SpnegoDjangoBackend, RemoteUserDjangoBackend, SAML2Backend, OpenIDBackend, or OAuthBackend, external users are created with superuser privileges.EPSS1.02%