Cloudera Manager =< 5.5 Process logs access (CVE-2016-4949)

Cloudera Manager =:7180/cmf/process//logs?filename=stderr,stdout.log The prerequisite to exploit this vulnerability is to know or iterate the targeted process identifier. The impact of the vulnerability is that a poorly developed process might contain sensitive information. The Cloudera CERT...

CVE-2016-4949

CVE-2016-4949 affects Cloudera Manager 5.5 and earlier. A remote attacker could obtain sensitive information by manipulating the filename parameter in the logs endpoint /cmf/process//logs, supplying either “stderr.log” or “stdout.log”. The underlying issue is an information disclosure in the proc...