Arbitrary File Write

hadoop-common is vulnerable to arbitrary file write.The vulnerable exists in the function unTar in FileUtil.java which allows an attacker to extract arbitrary files using symlink name...

Information Disclosure

hadoop-common is vulnerable to information disclosure. The vulnerability exists as an unauthenticated user can access a subset of servlets when kerberos authentication is enabled, and when SPNEGO through HTTP is not enabled...

Cross-site Scripting (XSS)

hadoop-common is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the display of the unsanitized remoteUser when an error is sent in the response...

Arbitrary File Write

Apache Hadoop Common is vulnerable to zip-slip vulnerability. The vulnerability exists when the attacker inputs a malicious zip archive with filenames including file traversal characters such as dot dot .., leading to concatenation of file path locating outside of the destination folder...

File Permission Manipulation Via Symlink Attack

hadoop-common-yarn is vulnerable to file permission manipulation. Using a symlink attack in a public tar archive, attackers can change the permissions on files to be world-readable...

Information Disclosure

hadoop-common is vulnerable to information disclosure. Malicious users can use XML directives in a configuration file to discover the job history on the server and to discover private files...

Information Disclosure

hadoop-common is vulnerable to information disclosure. The Jetty server version is leaked as a header in HTTP responses. Using this, attackers have a better idea of potential exploits which might work against the server...

Insecure Token Passwords

Hadoop-common is vulnerable to brute-force attacks due to insecure token passwords. When Kerberos security features are enabled, token passwords are generated using only a 20-bit secret. Leveraging this flaw, attacker can easily crack secret keys using a brute-force attack...