GHSA-7q56-mp4c-gggg

ghsaUSosv

Improper Access Control in Apache Hadoop

view advisory published 2022-05-17Licence: CC-BY-4.0

In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2016-5393US	high8.8	3.14% (88th)	—	2016-11-29
In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges a…

references

External citations — patches, advisories, analysis.

http://mail-archives.apache.org/mod_mbox/hadoop-general/201611.mbox/%3CCAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q%40mail.gmail.com%3EWEB
http://www.securityfocus.com/bid/94574WEB
https://nvd.nist.gov/vuln/detail/CVE-2016-5393ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan