CVE-2014-8733: Exposure of Sensitive Information to an Unauthorized Actor

Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in unspecified world-readable files under /etc/hadoop, which allows local users to obtain this password...

Cloudera Manager Detection

The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

Cloudera Manager < 4.8.3 Information Disclosure Vulnerability

Cloudera Manager is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WS-2014-0046

In “Cloudera/Hue”, in cdh4.5.0 to cdh5.3.10 and release-3.5.0 to release-3.7.1, there is an open redirection vulnerability. An attacker can manipulate the '?next=' parameter and once a user successfully logins to the site, there will be a redirection to the attacker’s site...

WS-2014-0051

In “Cloudera/Hue”, versions v0.9.1 to v3.7.1 and cdh5-base-2.3.0 to cdh5-base-3.7.0 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via POODLE attack...

WS-2014-0049

In “Cloudera/Hue”, versions v3.6.0 to v3.7.1 and cdh5-base-3.6.0 to cdh5-base-3.7.0 are vulnerable to CSRF attack...

WS-2014-0050

In “Cloudera/Hue”, versions v2.2.0 to v3.7.1 and cdh5-base-2.3.0 to cdh5-base-3.7.0 are vulnerable against Weak Password Requirements vulnerability which could allow an attacker to compromise a user account...

WS-2014-0047

In “Cloudera/Hue”, versions v3.6.0 to v3.7.1 and cdh5-base-3.6.0 to cdh5-base-3.7.0 are vulnerable to XSS in beeswax Query Editor and Hue home page...

WS-2014-0045

In “Cloudera/Hue”, in cdh4.1.0 to cdh5.2.6 and release-2.1.0 to release-3.7.1 there is a lack of CSRF protection. A successful attack causes a user's web browser to perform an unwanted action when the user is authenticated...

Cloudera Manager Detection

Binary data clouderamanagerdetect.nbin...

Cloudera Manager Default Credentials

The Cloudera Manager web application running on the remote web server uses default credentials for the administrator account. An attacker can exploit this to gain administrative access to the application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Cloudera Manager < 4.8.3 / 5.x < 5.0.1 Information Disclosure

The version of Cloudera Manager running on the remote host is prior to 4.8.3 or else 5.x prior to 5.0.1. It is, therefore, affected by an information disclosure vulnerability because the API fails to properly restrict access to sensitive data by non-administrator users. A low privilege user can...

Cloudera Manager Unsupported Version Detection

According to its self-reported version, the Cloudera Manager web application running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities...

Cloudera Manager information disclosure

Sensitive configuration information disclosure via API...

Details for CVE-2014-0220

------------------------------------------------------------------------------------------ Technical Service Bulletin 2014-28 TSB Title: Security Vulnerability: Sensitive Configuration Values Exposed in Cloudera Manager Certain configuration values that are stored in Cloudera Manager are consider...

CVE-2014-0220

Cloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to obtain sensitive configuration information via the API...

Design/Logic Flaw

Cloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to obtain sensitive configuration information via the API...

CVE-2014-0220

CVE-2014-0220 affects Cloudera Manager versions prior to 4.8.3 and prior to 5.0.1 in the 5.x line. The vulnerability is an information disclosure via the API, where remote authenticated users can obtain sensitive configuration values. The issue is tied to API access controls that fail to redact o...

CVE-2014-0220

Cloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to obtain sensitive configuration information via the API...

CVE-2014-0220: Exposure of Sensitive Information to an Unauthorized Actor

Cloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to obtain sensitive configuration information via the API...