Cloudera Manager =< 5.5 Stored and reflected XSS (CVE-2016-4948)

Cloudera Manager =:7180/cmf/hardware/hosts/templates - In the following fields of the Kerberos activation page, which can then be triggered visiting the page http://:7180/cmf/clusters/1/kerberos/wizard KDC Server Host Kerberos Security Realm Kerberos Encryption Types Advanced Configuration Snippe...

CVE-2016-4948

CVE-2016-4948 concerns multiple cross-site scripting (XSS) flaws in Cloudera Manager 5.5 and earlier. An attacker could inject arbitrary scripts via user-supplied input in (1) Template Name when renaming a template, (2) KDC Server host, (3) Kerberos Security Realm, (4) Kerberos Encryption Types, ...