Lucene search

[email protected]CVE-2015-1772

HistoryDec 21, 2015 - 11:59 a.m.

CVE-2015-1772

2015-12-2111:59:00

CWE-287

[email protected]

web.nvd.nist.gov

cve-2015-1772

ldap

hiveserver2

authentication

ibm infosphere biginsights

nvd

vulnerability

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

7.2 High

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

59.6%

JSON

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request.

CPENameOperatorVersion
ibm:infosphere_biginsightsibm infosphere biginsightseq3.0.0.2
ibm:infosphere_biginsightsibm infosphere biginsightseq3.0.0.0
ibm:infosphere_biginsightsibm infosphere biginsightseq3.0.0.1
apache:hiveapache hiveeq1.1.0
apache:hiveapache hiveeq1.0.0

CPE	Name	Operator	Version
ibm:infosphere_biginsights	ibm infosphere biginsights	eq	3.0.0.2
ibm:infosphere_biginsights	ibm infosphere biginsights	eq	3.0.0.0
ibm:infosphere_biginsights	ibm infosphere biginsights	eq	3.0.0.1
apache:hive	apache hive	eq	1.1.0
apache:hive	apache hive	eq	1.0.0

References

mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCAOpgucy52yzNN1FaRcxwhZmx8ZtNRjmK6V0Bxk4svAD-R1q70Q%40mail.gmail.com%3E

www-01.ibm.com/support/docview.wss?uid=swg21969546

www.securitytracker.com/id/1034365

www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

7.2 High

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

59.6%

JSON

Related for CVE-2015-1772

osv1 github1 prion1 cvelist1 ibm2