Read the docs
TI-2015-03438 Aliases CVE-2015-4078GHSA-2mqc-5vrf-pmw6

Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3…

Priority LOW 16CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).

Why it matters now

EPSS 0.00509 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:cloudera:cloudera_manager:5.3.0:*:*:*:*:*:*:*5.3.0VulnerableCloudera
cpe:2.3:a:cloudera:cloudera_manager:5.3.1:*:*:*:*:*:*:*5.3.1VulnerableCloudera
cpe:2.3:a:cloudera:cloudera_manager:5.3.2:*:*:*:*:*:*:*5.3.2VulnerableCloudera
cpe:2.3:a:cloudera:cloudera_manager:5.3.3:*:*:*:*:*:*:*5.3.3VulnerableCloudera
cpe:2.3:a:cloudera:cloudera_manager:5.4.0:*:*:*:*:*:*:*5.4.0VulnerableCloudera
cpe:2.3:a:cloudera:cloudera_manager:5.4.1:*:*:*:*:*:*:*5.4.1VulnerableCloudera
cpe:2.3:a:cloudera:navigator:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableCloudera
cpe:2.3:a:cloudera:navigator:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableCloudera
cpe:2.3:a:cloudera:navigator:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableCloudera
cpe:2.3:a:cloudera:navigator:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableCloudera
  • cpe:2.3:a:cloudera:cloudera_manager:5.3.0:*:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·Cloudera
  • cpe:2.3:a:cloudera:cloudera_manager:5.3.1:*:*:*:*:*:*:* Versions 5.3.1 Vulnerable ·Cloudera
  • cpe:2.3:a:cloudera:cloudera_manager:5.3.2:*:*:*:*:*:*:* Versions 5.3.2 Vulnerable ·Cloudera
  • cpe:2.3:a:cloudera:cloudera_manager:5.3.3:*:*:*:*:*:*:* Versions 5.3.3 Vulnerable ·Cloudera
  • cpe:2.3:a:cloudera:cloudera_manager:5.4.0:*:*:*:*:*:*:* Versions 5.4.0 Vulnerable ·Cloudera
  • cpe:2.3:a:cloudera:cloudera_manager:5.4.1:*:*:*:*:*:*:* Versions 5.4.1 Vulnerable ·Cloudera
  • cpe:2.3:a:cloudera:navigator:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Cloudera
  • cpe:2.3:a:cloudera:navigator:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Cloudera
  • cpe:2.3:a:cloudera:navigator:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Cloudera
  • cpe:2.3:a:cloudera:navigator:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Cloudera
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cloudera:navigator:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableCloudera
cpe:2.3:a:cloudera:navigator:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableCloudera
  • cpe:2.3:a:cloudera:navigator:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Cloudera
  • cpe:2.3:a:cloudera:navigator:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Cloudera

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-4078
  2. 2026-10-03 Alias added: GHSA-2mqc-5vrf-pmw6

References

Advisory 1

  • TI-2021-10679 Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges. CVSS 3.1CRITICAL 9.8
  • TI-2017-05053 Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows… CVSS 3.1HIGH 8.8
  • TI-2018-08405 Cloudera Manager through 5.15 has Incorrect Access Control. CVSS 3.0HIGH 8.1
  • TI-2015-05455 There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles. CVSS 3.1HIGH 7.5
  • TI-2017-06755 The keystore password for the Spark History Server may be exposed in unsecured files… CVSS 3.0HIGH 7.5
  • TI-2012-01987 Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when… CVSS 2.0MEDIUM 6.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences