VYPR
← All advisories
High severity8.8NVD Advisory· Published Oct 21, 2020· Updated Jun 17, 2026

CVE-2018-11764

CVE-2018-11764

Description

Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.hadoop:hadoop-mainMaven
>= 3.0.0-alpha4, < 3.0.13.0.1
org.apache.hadoop:hadoop-mainMaven
>= 3.0.0-beta1, < 3.0.13.0.1
org.apache.hadoop:hadoop-mainMaven
>= 3.0.0, < 3.0.13.0.1

Affected products

5
  • Apache/Hadoopdescription
  • ghsa-coords
    pkg:maven/org.apache.hadoop/hadoop-main
    Range: >= 3.0.0-alpha4, < 3.0.1
  • Apache/Hadoop3 versions
    cpe:2.3:a:apache:hadoop:3.0.0:-:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:apache:hadoop:3.0.0:-:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:3.0.0:alpha4:*:*:*:*:*:*
    • cpe:2.3:a:apache:hadoop:3.0.0:beta1:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.