VYPR
← All advisories
Medium severity6.8NVD Advisory· Published May 26, 2017· Updated Jun 17, 2026

CVE-2017-5646

CVE-2017-5646

Description

For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS through Apache Knox. This may result in escalated privileges and unauthorized data access. While this activity is audit logged and can be easily associated with the authenticated user, this is still a serious security issue. All users are recommended to upgrade to the Apache Knox 0.12.0 release.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.knox:gateway-provider-identity-assertion-commonMaven
>= 0.2.0, < 0.12.00.12.0

Affected products

12
  • Apache/Knox10 versions
    cpe:2.3:a:apache:knox:0.10.0:*:*:*:*:*:*:*+ 9 more
    • cpe:2.3:a:apache:knox:0.10.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:knox:0.11.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:knox:0.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:knox:0.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:knox:0.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:knox:0.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:knox:0.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:knox:0.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:knox:0.8.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:knox:0.9.0:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.knox/gateway-provider-identity-assertion-common
    Range: >= 0.2.0, < 0.12.0
  • Apache/Apachecpe-rescue
    Range: 0.2.0 to 0.11.0

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.