Cloudera

Records51All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high17CVSS 7.0–8.9

Exploited now

Cloudera records in CISA KEV

No Cloudera vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Cloudera Manager 22 records MEDIUM Cdh 11 records MEDIUM Hue 6 records MEDIUM Data Science Workbench 5 records MEDIUM Manager 3 records LOW Data Engineering 2 records LOW Cloudera Cdh 1 record LOW Cloudera Service And Configuration Manager 1 record LOW

Records

51 records

TI-2018-07979 CVE-2018-11215 · GHSA-pq9f-gcj3-hc3c

Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and…

MEDIUM 47

Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and prior releases via unspecified attack vectors.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02399 Published 2019-07-03 No fix listed CWE-200

TI-2021-10679 CVE-2021-30132 · GHSA-f7wm-pr55-wxgm

Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.

MEDIUM 44

Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01119 Published 2021-11-08 No fix listed

TI-2018-14236 CVE-2018-20091 · GHSA-rm2v-wh2x-rj6w

An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0…

MEDIUM 44

An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2.

CVSS 3.0CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0099 Published 2019-06-07 No fix listed CWE-89

TI-2015-03492 CVE-2015-4166 · GHSA-p2c6-q8wg-x69m

Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might…

MEDIUM 43

Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.00716 Published 2017-03-23 No fix listed CWE-320

TI-2025-03431 CVE-2025-3884 · GHSA-jj4j-jjmj-ghc2

Path traversal in Cloudera Hue

MEDIUM 42

Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01756 Published 2025-05-22 No fix listed CWE-22

TI-2017-11358 CVE-2017-15536 · GHSA-6gh6-8c4x-5346

An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.x before 1.2.0.

MEDIUM 40

An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.x before 1.2.0.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.00918 Published 2018-02-05 No fix listed CWE-269

TI-2017-05053 CVE-2017-7399 · GHSA-2jx7-jqgc-hgxg

Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows…

MEDIUM 40

Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00861 Published 2019-11-26 No fix listed CWE-269

TI-2016-03937 CVE-2016-4572 · GHSA-8p8c-cxfr-wq57

In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges.

MEDIUM 40

In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00861 Published 2019-11-26 No fix listed CWE-863

TI-2015-06506 CVE-2015-7831 · GHSA-558h-hw8g-9x57

In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.

MEDIUM 40

In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01078 Published 2019-11-26 No fix listed CWE-269

TI-2020-16363 CVE-2020-26936 · GHSA-c96p-67jc-gfv2

Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.

LOW 38

Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00454 Published 2020-11-26 No fix listed CWE-352

TI-2019-05206 CVE-2019-7319 · GHSA-g479-c966-m99h

An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0.

LOW 38

An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.01023 Published 2019-11-26 No fix listed CWE-269

TI-2018-14235 CVE-2018-20090 · GHSA-p4rw-m677-p78f

An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2.

LOW 38

An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00832 Published 2019-11-26 No fix listed CWE-276

TI-2018-08405 CVE-2018-11744 · GHSA-4hx4-9mqm-8p6r

Cloudera Manager through 5.15 has Incorrect Access Control.

LOW 37

Cloudera Manager through 5.15 has Incorrect Access Control.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.00928 Published 2019-07-11 No fix listed CWE-284

TI-2016-05655 CVE-2016-6605 · GHSA-hvcq-wqg4-xggp

Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization.

LOW 36

Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote attackers to bypass Setry authorization.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0136 Published 2017-04-10 No fix listed CWE-284

TI-2016-04273 CVE-2016-4950 · GHSA-4h29-fp66-hw4v

Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a…

LOW 36

Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01589 Published 2017-03-07 No fix listed CWE-200

TI-2016-04272 CVE-2016-4949 · GHSA-4mff-h543-gv34

Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information…

LOW 36

Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) stdout.log value in the filename parameter to /cmf/process/<process_id>/logs.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01616 Published 2017-03-07 No fix listed CWE-200

TI-2012-01366 CVE-2012-1574 · GHSA-c6f9-4pmv-m7m6

The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through…

LOW 36

The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.04772 Published 2012-04-12 Fixed in 0.23.2, 1.0.2 CWE-310

TI-2016-04968 CVE-2016-5724 · GHSA-5x59-c34p-cff9

Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles.

LOW 35

Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01234 Published 2019-11-26 No fix listed CWE-200

TI-2015-05455 CVE-2015-6495 · GHSA-4qq7-cgf7-vrf3

There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.

LOW 35

There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01071 Published 2019-11-26 No fix listed CWE-200

TI-2017-06755 CVE-2017-9326 · GHSA-4xqw-hr8p-jvp5

The keystore password for the Spark History Server may be exposed in unsecured files…

LOW 34

The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed by Cloudera Manager.

CVSS 3.0HIGH 7.5 Network Low privileges No interaction EPSS 0.00742 Published 2019-07-03 No fix listed CWE-255

TI-2017-06754 CVE-2017-9325 · GHSA-f9rj-ph86-rg7m

The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs.

LOW 34

The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00834 Published 2019-07-03 No fix listed CWE-285

TI-2018-12696 CVE-2018-17860 · GHSA-wc9g-6j64-h5vw

Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x…

LOW 33

Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00952 Published 2019-11-26 No fix listed CWE-276

TI-2012-01987 CVE-2012-2230 · GHSA-53g2-fc94-rp68

Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when…

LOW 33

Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote authenticated users to impersonate arbitrary…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01874 Published 2012-04-12 No fix listed CWE-310

TI-2014-00222 CVE-2014-0229 · GHSA-9r7g-325h-mxrm

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x…

LOW 32

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin comm…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01605 Published 2017-03-23 Fixed in 0.23.11, 2.4.1 CWE-264

TI-2021-02250 CVE-2021-3167 · GHSA-22x7-r7fc-8grh

In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to…

LOW 31

In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01149 Published 2021-03-15 No fix listed CWE-532

Open these records in search →