Vulnerabilities

TI-2025-03431 CVE-2025-3884 · GHSA-jj4j-jjmj-ghc2

Path traversal in Cloudera Hue

MEDIUM 42

Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01756 Published 2025-05-22 No fix listed CWE-22

TI-2021-12162 CVE-2021-32483 · GHSA-r5x5-46mf-mqcr

Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard.

LOW 25

Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00801 Published 2021-11-08 No fix listed

TI-2021-10679 CVE-2021-30132 · GHSA-f7wm-pr55-wxgm

Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.

MEDIUM 44

Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01119 Published 2021-11-08 No fix listed

TI-2021-10057 CVE-2021-29243 · GHSA-ppgw-3qcg-pv6p

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS.

LOW 28

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00586 Published 2021-11-08 No fix listed CWE-79

TI-2021-12161 CVE-2021-32482 · GHSA-3r67-gmwh-79ch

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter.

LOW 28

Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00586 Published 2021-11-08 No fix listed CWE-79

TI-2021-10610 CVE-2021-29994 · GHSA-pjrg-ghwc-jw95

Cloudera Hue 4.6.0 allows XSS.

LOW 29

Cloudera Hue 4.6.0 allows XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00901 Published 2021-11-08 No fix listed CWE-79

TI-2021-12160 CVE-2021-32481 · GHSA-38h5-q5q6-wmqj

Cloudera Hue 4.6.0 allows XSS via the type parameter.

LOW 28

Cloudera Hue 4.6.0 allows XSS via the type parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00668 Published 2021-11-08 No fix listed CWE-79

TI-2021-02250 CVE-2021-3167 · GHSA-22x7-r7fc-8grh

In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to…

LOW 31

In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01149 Published 2021-03-15 No fix listed CWE-532

TI-2020-16363 CVE-2020-26936 · GHSA-c96p-67jc-gfv2

Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.

LOW 38

Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00454 Published 2020-11-26 No fix listed CWE-352

TI-2019-10771 CVE-2019-14449 · GHSA-p49w-538h-63r7

An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and…

LOW 25

An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00521 Published 2019-11-26 No fix listed CWE-79

TI-2016-07576 CVE-2016-9271 · GHSA-x687-4r8f-56rh

Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.

LOW 25

Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00521 Published 2019-11-26 No fix listed CWE-79

TI-2017-05053 CVE-2017-7399 · GHSA-2jx7-jqgc-hgxg

Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows…

MEDIUM 40

Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00861 Published 2019-11-26 No fix listed CWE-269

TI-2019-05206 CVE-2019-7319 · GHSA-g479-c966-m99h

An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0.

LOW 38

An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.01023 Published 2019-11-26 No fix listed CWE-269

TI-2018-14235 CVE-2018-20090 · GHSA-p4rw-m677-p78f

An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2.

LOW 38

An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00832 Published 2019-11-26 No fix listed CWE-276

TI-2018-12696 CVE-2018-17860 · GHSA-wc9g-6j64-h5vw

Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x…

LOW 33

Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00952 Published 2019-11-26 No fix listed CWE-276

TI-2015-03737 CVE-2015-4457 · GHSA-2xmv-x4hx-jg8j

Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before…

LOW 25

Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00622 Published 2019-11-26 No fix listed CWE-79

TI-2015-05455 CVE-2015-6495 · GHSA-4qq7-cgf7-vrf3

There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.

LOW 35

There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01071 Published 2019-11-26 No fix listed CWE-200

TI-2015-06506 CVE-2015-7831 · GHSA-558h-hw8g-9x57

In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.

MEDIUM 40

In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01078 Published 2019-11-26 No fix listed CWE-269

TI-2016-02625 CVE-2016-3131 · GHSA-2424-v4cf-7rr6

Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls.

LOW 30

Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00667 Published 2019-11-26 No fix listed CWE-863

TI-2016-02678 CVE-2016-3192 · GHSA-3692-hqvq-62f5

Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files.

LOW 30

Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0061 Published 2019-11-26 No fix listed CWE-312

TI-2016-03937 CVE-2016-4572 · GHSA-8p8c-cxfr-wq57

In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges.

MEDIUM 40

In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00861 Published 2019-11-26 No fix listed CWE-863

TI-2016-04968 CVE-2016-5724 · GHSA-5x59-c34p-cff9

Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles.

LOW 35

Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01234 Published 2019-11-26 No fix listed CWE-200

TI-2016-05441 CVE-2016-6353 · GHSA-xfq9-m5c5-8p4q

Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr…

LOW 30

Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the RealTimeGetHandler.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00751 Published 2019-11-26 No fix listed CWE-863

TI-2018-08405 CVE-2018-11744 · GHSA-4hx4-9mqm-8p6r

Cloudera Manager through 5.15 has Incorrect Access Control.

LOW 37

Cloudera Manager through 5.15 has Incorrect Access Control.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.00928 Published 2019-07-11 No fix listed CWE-284

TI-2017-06754 CVE-2017-9325 · GHSA-f9rj-ph86-rg7m

The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs.

LOW 34

The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00834 Published 2019-07-03 No fix listed CWE-285

Vulnerabilities

Filters