CVE-2015-8094

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...

CVE-2015-8094

CVE-2015-8094 is an open redirect vulnerability in Cloudera Hue prior to 3.10.0. The issue allows remote attackers to redirect users to arbitrary sites and conduct phishing via a URL supplied in the next parameter. Affected software: Cloudera Hue before 3.10.0. Root cause and exploit details are ...

CVE-2015-8094: URL Redirection to Untrusted Site

Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter...

PT-2018-4438

Name of the Vulnerable Software and Affected Versions Cloudera HUE versions prior to 3.10.0 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter. This can be exploited by including a malicious URL in th...

WS-2018-0634

In “Cloudera/Hue”, cdh5.12.0 to cdh5.13.2, cdh5.14.0 and v4.0.0 to v4.1.0 are vulnerable against XSS in Hue Admin Interface...

WS-2018-0635

In “Cloudera/Hue”, v2.0.0 to v4.2.0, cdh4.0.0 to cdh5.14.0 and cdh4-base-2.0.0 to cdh4-base-2.5.0 are vulnerable as a result of an exposed LDAP password returned as ‘args’...

CVE-2017-15536

An issue was discovered in Cloudera Data Science Workbench CDSW 1.x before 1.2.0. Several web application vulnerabilities allow malicious authenticated users of CDSW to escalate privileges in CDSW. CDSW users can exploit these vulnerabilities in combination to gain root access to CDSW nodes, gain...

Design/Logic Flaw

An issue was discovered in Cloudera Data Science Workbench CDSW 1.x before 1.2.0. Several web application vulnerabilities allow malicious authenticated users of CDSW to escalate privileges in CDSW. CDSW users can exploit these vulnerabilities in combination to gain root access to CDSW nodes, gain...

CVE-2017-15536

An issue was discovered in Cloudera Data Science Workbench CDSW 1.x before 1.2.0. Several web application vulnerabilities allow malicious authenticated users of CDSW to escalate privileges in CDSW. CDSW users can exploit these vulnerabilities in combination to gain root access to CDSW nodes, gain...

CVE-2017-15536

CVE-2017-15536 affects Cloudera Data Science Workbench (CDSW) 1.x before 1.2.0. The CDSW web application contains multiple vulnerabilities that allow malicious authenticated users to escalate privileges within CDSW. By chaining these weaknesses, an attacker can achieve root access to CDSW nodes, ...

CVE-2017-15536

An issue was discovered in Cloudera Data Science Workbench CDSW 1.x before 1.2.0. Several web application vulnerabilities allow malicious authenticated users of CDSW to escalate privileges in CDSW. CDSW users can exploit these vulnerabilities in combination to gain root access to CDSW nodes, gain...

Cloudera Data Science Workbench Elevation of Privilege Vulnerability

Cloudera Data Science Workbench CDSW is a suite of data science platforms from US-based Cloudera. The platform provides fast, easy and secure self-service data science support for organizations. A security vulnerability exists in CDSW 1.2.0 prior to version 1.x. The vulnerability can be exploited...

CVE-2017-15536: Improper Privilege Management

An issue was discovered in Cloudera Data Science Workbench CDSW 1.x before 1.2.0. Several web application vulnerabilities allow malicious authenticated users of CDSW to escalate privileges in CDSW. CDSW users can exploit these vulnerabilities in combination to gain root access to CDSW nodes, gain...

PT-2018-5907

Name of the Vulnerable Software and Affected Versions: Cloudera Data Science Workbench versions prior to 1.2.0 Description: An issue in Cloudera Data Science Workbench allows malicious authenticated users to escalate privileges. By exploiting several web application vulnerabilities, users can gai...

WS-2017-3763

In “Cloudera/Hue”, versions v3.11.0 to v4.1.0 and cdh5.9.0-rc1 to cdh5.12.1-release are vulnerable to XSS in the table row display modal, HueData table and TableExtender2...

WS-2017-3762

In “Cloudera/Hue”, cdh5.4.0 to cdh5.13.0 and v3.8.0 to v4.1.0, are vulnerable against XSS via the default html binding...

WS-2017-3761

In “Cloudera/Hue”, versions 4.0.0 to 4.1.0 and cdh5.13.0-rc1 to cdh5.13.0-release are vulnerable to xss in the wysiwyg5 editor...

Apache Impala 2.8.0 Authentication Bypass Vulnerability

Apache Impala versions 2.7.0 through 2.8.0 suffers from an information disclosure vulnerability. It was noticed that a malicious process impersonating an Impala daemon could cause Impala daemons to skip authentication checks when Kerberos is enabled but TLS is not. If the malicious server respond...

Cloudera Manager Configuration Download Vulnerability

Cloudera Manager is prone to an information disclosure vulnerability where a unauthenticated attacker may download module configurations. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Cloudera HUE Session cookies stored in the database

User session cookies are stored in the database. Combined with the vulnerability related to configuration file which is world readable, it is possible to spoof a user across the entire cluster launching jobs and browsing the datalake, without having to crack password hashes. Cookies are stored in...