EUVD-2017-14734

Malware in sbrugna...

CVE-2021-42357

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be...

Apache Knox allows impersonation of users

For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS through Apache Knox. This may result in escalated privileges and unauthorized data access. While this activity is audit logged and can be...

org.apache.knox:gateway-provider-identity-assertion-concat (>=0.6.0, <=0.11.0), org.apache.knox:gateway-provider-identity-assertion-hadoop-groups (0.11.0) +4 more potentially affected by CVE-2017-5646 via org.apache.knox:gateway-provider-identity-assertion-common (>=0.6.0, <=0.11.0)

org.apache.knox:gateway-provider-identity-assertion-common MAVEN version =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.9.0, =0.6.0, =0.7.0 Source cves: CVE-2017-5646 Source advisory: OSV:GHSA-G3FC-8JV4-QMMV...

org.apache.knox:gateway-provider-identity-assertion-concat (>=0.6.0, <=0.11.0), org.apache.knox:gateway-provider-identity-assertion-hadoop-groups (0.11.0) +4 more potentially affected by CVE-2017-5646 via org.apache.knox:gateway-provider-identity-assertion-common (>=0.6.0, <=0.11.0)

org.apache.knox:gateway-provider-identity-assertion-common MAVEN version =0.6.0, =0.6.0, =0.6.0, =0.7.0, =0.9.0, =0.6.0, =0.7.0 Source cves: CVE-2017-5646 Source advisory: GHSA-G3FC-8JV4-QMMV...

GHSA-G3FC-8JV4-QMMV Apache Knox allows impersonation of users

For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS through Apache Knox. This may result in escalated privileges and unauthorized data access. While this activity is audit logged and can be...

org.apache.knox:gateway-release (>=1.0.0, <=1.1.0), org.apache.knox:gateway-test-release (>=1.0.0, <=1.1.0) +3 more potentially affected by CVE-2021-42357 via org.apache.knox:gateway-service-knoxsso (>=1.0.0, <=1.1.0)

org.apache.knox:gateway-service-knoxsso MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0 Source cves: CVE-2021-42357 Source advisory: GHSA-VV38-4XCJ-Q4RW...

Cross-site Scripting in Apache Knox SSO

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be...

org.apache.knox:gateway-release (0.14.0), org.apache.knox:gateway-test-release (0.14.0) +3 more potentially affected by CVE-2021-42357 via org.apache.knox:gateway-service-knoxsso (0.14.0)

org.apache.knox:gateway-service-knoxsso MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.knox:gateway-service-knoxsso and may be impacted: - org.apache.knox:gateway-release 0.14.0 - org.apache.knox:gateway-test-release...

org.apache.knox:gateway-release (>=1.0.0, <=1.1.0), org.apache.knox:gateway-test-release (>=1.0.0, <=1.1.0) +3 more potentially affected by CVE-2021-42357 via org.apache.knox:gateway-service-knoxsso (>=1.0.0, <=1.1.0)

org.apache.knox:gateway-service-knoxsso MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0 Source cves: CVE-2021-42357 Source advisory: OSV:GHSA-VV38-4XCJ-Q4RW...

Apache Knox SSO Cross-Site Scripting Vulnerability

Knox Sso is the Apache Foundation's Web Ui Sso Single Sign-On feature for your cluster. A security vulnerability exists in Apache Knox SSO that stems from a URL parsing error that could craft requests to redirect users to a malicious page. A request containing a specially crafted request paramete...

CVE-2021-42357

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be...

CVE-2021-42357

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be...

CVE-2021-42357

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be...

Design/Logic Flaw

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be...

org.apache.knox:gateway-release (>=0.14.0, <=1.1.0), org.apache.knox:gateway-test-release (>=0.14.0, <=1.1.0) +3 more potentially affected by CVE-2021-42357 via org.apache.knox:gateway-service-knoxsso (>=0.14.0, <=1.1.0)

org.apache.knox:gateway-service-knoxsso MAVEN version =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =1.1.0 Source cves: CVE-2021-42357 Source advisory: MEND:CVE-2021-42357...

CVE-2021-42357

CVE-2021-42357 affects Apache Knox SSO prior to 1.6.1. The issue arises from improper URL parsing, allowing a crafted request parameter to redirect users to an attacker-controlled page. Practical impact described across sources is a user-facing redirect that would need exposure outside the normal...

CVE-2021-42357 DOM based XSS Vulnerability in Apache Knox

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be...

CVE-2021-42357

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be...

Apache Knox SSO cross-site scripting vulnerability

Knox Sso is the Apache Foundation's Web Ui Sso Single Sign-On feature for your cluster. A security vulnerability exists in Apache Knox SSO that stems from a URL parsing error that could craft requests to redirect users to a malicious page. A request containing a specially crafted request paramete...