Manager
by Cloudera
CVEs (22)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-4950 | Hig | 0.49 | 7.5 | 0.02 | Mar 7, 2017 | Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions. | ||
| CVE-2016-4949 | Hig | 0.49 | 7.5 | 0.02 | Mar 7, 2017 | Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) stdout.log value in the filename parameter to /cmf/process/<process_id>/logs. | ||
| CVE-2016-4948 | Med | 0.40 | 6.1 | 0.01 | Mar 7, 2017 | Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Template Name field when renaming a template; (2) KDC Server host, (3) Kerberos Security Realm, (4) Kerberos… | ||
| CVE-2015-2263 | Low | 0.21 | 3.3 | 0.00 | Mar 23, 2017 | Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the… | ||
| CVE-2015-4078 | Low | 0.20 | 3.1 | 0.01 | Mar 23, 2017 | Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). | ||
| CVE-2021-32483 | 0.00 | — | 0.01 | Nov 8, 2021 | Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard. | |||
| CVE-2021-30132 | 0.00 | — | 0.01 | Nov 8, 2021 | Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges. | |||
| CVE-2021-29243 | 0.00 | — | 0.01 | Nov 8, 2021 | Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS. | |||
| CVE-2021-32482 | 0.00 | — | 0.01 | Nov 8, 2021 | Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter. | |||
| CVE-2019-14449 | 0.00 | — | 0.01 | Nov 26, 2019 | An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this product. | |||
| CVE-2016-9271 | 0.00 | — | 0.01 | Nov 26, 2019 | Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature. | |||
| CVE-2017-7399 | 0.00 | — | 0.01 | Nov 26, 2019 | Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users. | |||
| CVE-2015-4457 | 0.00 | — | 0.01 | Nov 26, 2019 | Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors. | |||
| CVE-2015-6495 | 0.00 | — | 0.01 | Nov 26, 2019 | There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles. | |||
| CVE-2016-3192 | 0.00 | — | 0.01 | Nov 26, 2019 | Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files. | |||
| CVE-2018-11744 | 0.00 | — | 0.01 | Jul 11, 2019 | Cloudera Manager through 5.15 has Incorrect Access Control. | |||
| CVE-2018-15913 | 0.00 | — | 0.01 | Jun 20, 2019 | An issue was discovered in Cloudera Manager 5.x through 5.15.0. One type of page in Cloudera Manager uses a 'returnUrl' parameter to redirect the user to another page in Cloudera Manager once a wizard is completed. The validity of this parameter was not checked. As a result, the… | |||
| CVE-2018-5798 | 0.00 | — | 0.01 | Jun 7, 2019 | This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager. | |||
| CVE-2018-10815 | 0.00 | — | 0.01 | May 24, 2019 | An issue was discovered in Cloudera Manager before 5.13.4, 5.14.x before 5.14.4, and 5.15.x before 5.15.1. A read-only user can access sensitive cluster information. | |||
| CVE-2014-8733 | 0.00 | — | 0.00 | Feb 10, 2015 | Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in unspecified world-readable files under /etc/hadoop, which allows local users to obtain this password. |
- risk 0.49cvss 7.5epss 0.02
Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions.
- risk 0.49cvss 7.5epss 0.02
Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) stdout.log value in the filename parameter to /cmf/process/<process_id>/logs.
- risk 0.40cvss 6.1epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Template Name field when renaming a template; (2) KDC Server host, (3) Kerberos Security Realm, (4) Kerberos…
- risk 0.21cvss 3.3epss 0.00
Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the…
- risk 0.20cvss 3.1epss 0.01
Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
- CVE-2021-32483Nov 8, 2021risk 0.00cvss —epss 0.01
Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard.
- CVE-2021-30132Nov 8, 2021risk 0.00cvss —epss 0.01
Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.
- CVE-2021-29243Nov 8, 2021risk 0.00cvss —epss 0.01
Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS.
- CVE-2021-32482Nov 8, 2021risk 0.00cvss —epss 0.01
Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter.
- CVE-2019-14449Nov 26, 2019risk 0.00cvss —epss 0.01
An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this product.
- CVE-2016-9271Nov 26, 2019risk 0.00cvss —epss 0.01
Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.
- CVE-2017-7399Nov 26, 2019risk 0.00cvss —epss 0.01
Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users.
- CVE-2015-4457Nov 26, 2019risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors.
- CVE-2015-6495Nov 26, 2019risk 0.00cvss —epss 0.01
There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.
- CVE-2016-3192Nov 26, 2019risk 0.00cvss —epss 0.01
Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files.
- CVE-2018-11744Jul 11, 2019risk 0.00cvss —epss 0.01
Cloudera Manager through 5.15 has Incorrect Access Control.
- CVE-2018-15913Jun 20, 2019risk 0.00cvss —epss 0.01
An issue was discovered in Cloudera Manager 5.x through 5.15.0. One type of page in Cloudera Manager uses a 'returnUrl' parameter to redirect the user to another page in Cloudera Manager once a wizard is completed. The validity of this parameter was not checked. As a result, the…
- CVE-2018-5798Jun 7, 2019risk 0.00cvss —epss 0.01
This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager.
- CVE-2018-10815May 24, 2019risk 0.00cvss —epss 0.01
An issue was discovered in Cloudera Manager before 5.13.4, 5.14.x before 5.14.4, and 5.15.x before 5.15.1. A read-only user can access sensitive cluster information.
- CVE-2014-8733Feb 10, 2015risk 0.00cvss —epss 0.00
Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in unspecified world-readable files under /etc/hadoop, which allows local users to obtain this password.
Page 1 of 2