Cloudera HUE =< 3.9.0 Enumerating users with an unprivileged account (CVE-2016-4947)

Cloudera HUE =/desktop/api/users/autocomplete Open redirection Cloudera HUE =:8888/accounts/login/?next=//google.fr...

CVE-2016-4947

CVE-2016-4947 affects Cloudera HUE 3.9.0 and earlier, where a remote attacker can enumerate user accounts by sending a request to desktop/api/users/autocomplete. The impact is user enumeration via a publicly accessible endpoint; no exploit details are provided beyond the endpoint, and the connect...