Описание
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user.
This issue affects Apache Impala: >=4.0.0.
Users are recommended to upgrade to version 4.5.2, which fixes this issue.
Ссылки
- Mailing ListVendor Advisory
- Mailing ListThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 4.0.0 (включая) до 4.5.2 (исключая)
cpe:2.3:a:apache:impala:*:*:*:*:*:*:*:*
EPSS
Процентиль: 39%
0.00468
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-347
Связанные уязвимости
CVSS3: 9.8
github
6 дней назад
Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user. This issue affects Apache Impala: >=4.0.0. Users are recommended to upgrade to version 4.5.2, which fixes this issue.
EPSS
Процентиль: 39%
0.00468
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-347