Vulnerabilities

TI-2016-04273 CVE-2016-4950 · GHSA-4h29-fp66-hw4v

Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a…

LOW 36

Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01589 Published 2017-03-07 No fix listed CWE-200

TI-2016-04272 CVE-2016-4949 · GHSA-4mff-h543-gv34

Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information…

LOW 36

Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) stdout.log value in the filename parameter to /cmf/process/<process_id>/logs.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01616 Published 2017-03-07 No fix listed CWE-200

TI-2016-04271 CVE-2016-4948 · GHSA-xmfp-xxv3-g2c5

Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier…

LOW 28

Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Template Name field when renaming a template; (2) KDC Serv…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00524 Published 2017-03-07 No fix listed CWE-79

Vulnerabilities

Filters

Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a…

Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information…

Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier…