CVE-2015-7831

In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used...

CVE-2015-7831

CVE-2015-7831 affects Cloudera Hue with privilege escalation for a read-only user when CDH 5.x before 5.4.9 is used. The NVD entry documents the vulnerability with CVSS 2.0/3.1 scores (base 6.5 and 8.8, respectively) and an attack path described as network-based with low attack complexity and no ...

CVE-2016-3131

Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls...

CVE-2016-3131

The CVE-2016-3131 entry concerns Cloudera CDH before 5.6.1, where an authorization bypass is possible via direct internal API calls. Affected software is Cloudera CDH (pre-5.6.1); the root cause is bypass of access control through internal API calls. Documented impact includes potential to elevat...

CVE-2016-4572

CVE-2016-4572 affects Cloudera CDH versions prior to 5.7.1, where Impala REVOKE ALL ON SERVER commands fail to revoke all privileges. The risk is that some privileges may remain active for affected roles/services. The connected Red Hat and CNVD entries corroborate the same description. No explici...

CVE-2016-4572

In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges...

CVE-2016-5724

CVE-2016-5724 affects Cloudera CDH prior to 5.9. The vulnerability is an information disclosure risk in the Diagnostic Support Bundles, allowing a remote attacker to obtain potentially sensitive information from those bundles. The issue is described consistently across connected sources as a flaw...

CVE-2016-5724

Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles...

CVE-2016-6353

CVE-2016-6353 affects Cloudera CDH’s Cloudera Search component. The vulnerability arises in Solr Queries by document ID that can bypass Sentry document-level security via the RealTimeGetHandler, permitting unauthorized access to documents. Affected software is Cloudera CDH with Cloudera Search (p...

CVE-2016-6605

Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization...

Authorization

Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization...

CVE-2016-6605

Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization...

CVE-2016-6605

Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization...

CVE-2016-6605

CVE-2016-6605 affects Cloudera CDH's Impala: versions 5.2.0 through 5.7.2 and 5.8.0 are vulnerable. The root cause is a Setry (likely Sentry) authorization bypass in Impala, enabling remote attackers to bypass access controls. Public documentation in connected sources confirms the affected produc...

Cloudera CDH Apache Hadoop Security Bypass Vulnerability

Cloudera CDH is an open source platform for running Apache Hadoop from Cloudera Inc. Apache Hadoop is an open source distributed systems infrastructure that enables distributed processing of large amounts of data with high reliability, high scalability, high fault tolerance and other features. A...

CVE-2014-0229

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the 1 refreshNamenodes, 2 deleteBlockPool, and 3 shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service DataNode...

Authentication flaw

The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows remote authenticated users to obtain sensitive job information by leveraging failure to enforce job ACLs...

CVE-2013-6446

The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows remote authenticated users to obtain sensitive job information by leveraging failure to enforce job ACLs...

CVE-2014-0229

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1 (and Cloudera CDH 5.0.x before 5.0.2) fail to check authorization for HDFS admin commands refreshNamenodes, deleteBlockPool, and shutdownDatanode. This allows remote authenticated users to cause DataNodes to shut down or perform unnecessary...

CVE-2013-6446

The CVE concerns the JobHistory Server in Cloudera CDH 4.x prior to 4.6.0 and CDH 5.x prior to 5.0.0 Beta 2. When MRv2/YARN is used with HTTP authentication, remote authenticated users can obtain sensitive job information due to failure to enforce job ACLs. The description does not specify affect...