Cloudera

Records51All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high17CVSS 7.0–8.9

Exploited now

Cloudera records in CISA KEV

No Cloudera vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Cloudera Manager 22 records MEDIUM Cdh 11 records MEDIUM Hue 6 records MEDIUM Data Science Workbench 5 records MEDIUM Manager 3 records LOW Data Engineering 2 records LOW Cloudera Cdh 1 record LOW Cloudera Service And Configuration Manager 1 record LOW

Records

22 records in Cloudera Manager · all components

TI-2021-10679 CVE-2021-30132 · GHSA-f7wm-pr55-wxgm

Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.

MEDIUM 44

Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01119 Published 2021-11-08 No fix listed

TI-2017-05053 CVE-2017-7399 · GHSA-2jx7-jqgc-hgxg

Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows…

MEDIUM 40

Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00861 Published 2019-11-26 No fix listed CWE-269

TI-2018-08405 CVE-2018-11744 · GHSA-4hx4-9mqm-8p6r

Cloudera Manager through 5.15 has Incorrect Access Control.

LOW 37

Cloudera Manager through 5.15 has Incorrect Access Control.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.00928 Published 2019-07-11 No fix listed CWE-284

TI-2015-05455 CVE-2015-6495 · GHSA-4qq7-cgf7-vrf3

There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.

LOW 35

There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01071 Published 2019-11-26 No fix listed CWE-200

TI-2017-06755 CVE-2017-9326 · GHSA-4xqw-hr8p-jvp5

The keystore password for the Spark History Server may be exposed in unsecured files…

LOW 34

The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed by Cloudera Manager.

CVSS 3.0HIGH 7.5 Network Low privileges No interaction EPSS 0.00742 Published 2019-07-03 No fix listed CWE-255

TI-2012-01987 CVE-2012-2230 · GHSA-53g2-fc94-rp68

Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when…

LOW 33

Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote authenticated users to impersonate arbitrary…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01874 Published 2012-04-12 No fix listed CWE-310

TI-2017-06756 CVE-2017-9327 · GHSA-fm65-9j8v-c7qh

Secret data of processes managed by CM is not secured by file permissions.

LOW 31

Secret data of processes managed by CM is not secured by file permissions.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01232 Published 2019-07-03 No fix listed CWE-275

TI-2018-07644 CVE-2018-10815 · GHSA-28cc-rgm2-57m9

An issue was discovered in Cloudera Manager before 5.13.4, 5.14.x before 5.14.4, and…

LOW 30

An issue was discovered in Cloudera Manager before 5.13.4, 5.14.x before 5.14.4, and 5.15.x before 5.15.1.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00867 Published 2019-05-24 No fix listed CWE-200

TI-2016-02678 CVE-2016-3192 · GHSA-3692-hqvq-62f5

Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files.

LOW 30

Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0061 Published 2019-11-26 No fix listed CWE-312

TI-2021-12161 CVE-2021-32482 · GHSA-3r67-gmwh-79ch

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter.

LOW 28

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00586 Published 2021-11-08 No fix listed CWE-79

TI-2021-10057 CVE-2021-29243 · GHSA-ppgw-3qcg-pv6p

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS.

LOW 28

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00586 Published 2021-11-08 No fix listed CWE-79

TI-2018-11349 CVE-2018-15913 · GHSA-5m3h-gcpg-742g

An issue was discovered in Cloudera Manager 5.x through 5.15.0.

LOW 28

An issue was discovered in Cloudera Manager 5.x through 5.15.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00648 Published 2019-06-20 No fix listed CWE-79

TI-2018-04198 CVE-2018-5798 · GHSA-rj2q-3rhf-2wrq

This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager.

LOW 28

This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00654 Published 2019-06-07 No fix listed CWE-79

TI-2021-12162 CVE-2021-32483 · GHSA-r5x5-46mf-mqcr

Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard.

LOW 25

Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00801 Published 2021-11-08 No fix listed

TI-2019-10771 CVE-2019-14449 · GHSA-p49w-538h-63r7

An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and…

LOW 25

An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00521 Published 2019-11-26 No fix listed CWE-79

TI-2016-07576 CVE-2016-9271 · GHSA-x687-4r8f-56rh

Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.

LOW 25

Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00521 Published 2019-11-26 No fix listed CWE-79

TI-2015-03737 CVE-2015-4457 · GHSA-2xmv-x4hx-jg8j

Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before…

LOW 25

Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00622 Published 2019-11-26 No fix listed CWE-79

TI-2018-04543 CVE-2018-6185 · GHSA-5c76-8684-p245

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow…

LOW 23

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys.

CVSS 3.0MEDIUM 4.9 Network High privileges No interaction EPSS 0.00447 Published 2019-06-07 No fix listed CWE-310

TI-2014-00213 CVE-2014-0220 · GHSA-9v29-jj89-qr6f

Cloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to…

LOW 23

Cloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to obtain sensitive configuration information via the API.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.0185 Published 2014-06-10 No fix listed CWE-200

TI-2015-03438 CVE-2015-4078 · GHSA-2mqc-5vrf-pmw6

Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3…

LOW 16

Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle a…

CVSS 3.0LOW 3.1 Network No auth User interaction EPSS 0.00509 Published 2017-03-23 No fix listed CWE-200

TI-2015-02003 CVE-2015-2263 · GHSA-6whv-hjxj-235c

Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and…

LOW 16

Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows…

CVSS 3.0LOW 3.3 Local Low privileges No interaction EPSS 0.00279 Published 2017-03-23 No fix listed CWE-264

TI-2014-07163 CVE-2014-8733 · GHSA-7cxr-6g78-9f3p

Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in…

LOW 11

Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in unspecified world-readable files under /etc/hadoop, which allows local users to obtain this password.

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00318 Published 2015-02-10 No fix listed CWE-200

Open these records in search →