CVE-2013-6446

Опубликовано: 23 мар. 2017

Источник: nvd

CVSS3: 3.1

CVSS2: 3.5

EPSS Низкий

Описание

The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows remote authenticated users to obtain sensitive job information by leveraging failure to enforce job ACLs.

Ссылки

http://www.securityfocus.com/bid/97068
Third Party Advisory
VDB Entry
https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_mfb_qpm_4n
Vendor Advisory
http://www.securityfocus.com/bid/97068
Third Party Advisory
VDB Entry
https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_mfb_qpm_4n
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cloudera:cdh:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.1.0:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.1.1:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.1.2:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.1.3:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.1.4:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.1.5:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.3.0:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.3.1:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.3.2:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.4.0:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:4.5.0:*:*:*:*:*:*:*

cpe:2.3:a:cloudera:cdh:5.0.0:beta:*:*:*:*:*:*

EPSS

Процентиль: 43%

0.00209

Низкий

3.1 Low

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-wwhw-vwhw-7mxv