Medium severity6.1NVD Advisory· Published Mar 7, 2017· Updated Jun 17, 2026

CVE-2016-4946

Description

Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) First name or (2) Last name field in the HUE Users page.

Affected products

Cloudera/Hue2 versions
cpe:2.3:a:cloudera:hue:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:cloudera:hue:*:*:*:*:*:*:*:*range: <=3.9.0
- (no CPE)range: <=3.9.0

Patches

Vulnerability mechanics

References

2016.hack.lu/archive/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdfnvdThird Party Advisory
www.securityfocus.com/bid/93881nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000