CVE-2018-15913

An issue was discovered in Cloudera Manager 5.x through 5.15.0. One type of page in Cloudera Manager uses a 'returnUrl' parameter to redirect the user to another page in Cloudera Manager once a wizard is completed. The validity of this parameter was not checked. As a result, the user could be...

CVE-2018-15913

CVE-2018-15913 affects Cloudera Manager versions 5.x through 5.15.0. An unchecked returnUrl parameter on a wizard page can redirect to external sites or trigger malicious JavaScript-based XSS. The fix implemented was to disallow any returnUrl values that match patterns like http://, https://, //,...

Cloudera Navigator Key Trustee KMS Encryption Issue Vulnerability

Cloudera Navigator Key Trustee KMS is a customized secret key management server from Cloudera. A security vulnerability exists in Cloudera Navigator Key Trustee KMS versions 5.12 and 5.13. An attacker can exploit the vulnerability to recover previously deleted but not cleaned keys or delete the...

Cloudera Manager Cross-Site Scripting Vulnerability

Cloudera Manager is a suite of Hadoop data management software from Cloudera. The software supports creating clusters, authentication, data backup and recovery, and more. A cross-site scripting vulnerability exists in Cloudera Manager. The vulnerability stems from the lack of proper authenticatio...

Cloudera Data Science Workbench SQL Injection Vulnerability

Cloudera Data Science Workbench CDSW is a suite of data science platforms from Cloudera. The platform provides organizations with fast, easy and secure self-service data science support. A SQL injection vulnerability exists in Cloudera CDSW versions 1.4.0 through 1.4.2. The vulnerability stems fr...

CVE-2018-20091

An SQL injection vulnerability was found in Cloudera Data Science Workbench CDSW 1.4.0 through 1.4.2. This would allow any authenticated user to run arbitrary queries against CDSW's internal database. The database contains user contact information, encrypted CDSW passwords in the case of local...

CVE-2018-20091

An SQL injection vulnerability was found in Cloudera Data Science Workbench CDSW 1.4.0 through 1.4.2. This would allow any authenticated user to run arbitrary queries against CDSW's internal database. The database contains user contact information, encrypted CDSW passwords in the case of local...

Sql injection

An SQL injection vulnerability was found in Cloudera Data Science Workbench CDSW 1.4.0 through 1.4.2. This would allow any authenticated user to run arbitrary queries against CDSW's internal database. The database contains user contact information, encrypted CDSW passwords in the case of local...

CVE-2018-20091

CVEResult: Affected product is Cloudera Data Science Workbench (CDSW) versions 1.4.0–1.4.2. The issue is an SQL injection that would allow any authenticated user to execute arbitrary SQL queries against CDSW’s internal database. The internal DB stores user contact information, encrypted CDSW pass...

CVE-2018-20091

An SQL injection vulnerability was found in Cloudera Data Science Workbench CDSW 1.4.0 through 1.4.2. This would allow any authenticated user to run arbitrary queries against CDSW's internal database. The database contains user contact information, encrypted CDSW passwords in the case of local...

CVE-2018-5798

This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager...

CVE-2018-5798

This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager...

Cross site scripting

This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager...

CVE-2018-6185

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

Design/Logic Flaw

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

CVE-2018-6185

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

CVE-2018-5798

Cloudera Manager is affected by a cross-site scripting (XSS) vulnerability described in CNVD-2019-17136 as arising from lack of proper authentication of client data by the WEB application, enabling an attacker to execute client-side code. The CVE entry itself and other sources label it as an unsp...

CVE-2018-5798

This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager...

CVE-2018-6185

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for...

CVE-2018-6185

CVE-2018-6185 concerns Cloudera Navigator Key Trustee KMS (versions 5.12 and 5.13). The root cause is an incorrect default ACL configuration for the two additional APIs (PURGE and UNDELETE) that govern encryption-zone keys; the ACLs default to “*”, permitting remote access to these commands. This...