Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-1296

In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.

Published

2019-02-07T22:29:00.240

Last Modified

2024-11-21T03:59:34.033

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-200
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache hadoop ≤ 2.7.5 Yes
Application apache hadoop 2.8.0 Yes
Application apache hadoop 2.8.1 Yes
Application apache hadoop 2.8.2 Yes
Application apache hadoop 2.8.3 Yes
Application apache hadoop 2.9.0 Yes
Application apache hadoop 3.0.0 Yes
Application apache hadoop 3.0.0 Yes
Application apache hadoop 3.0.0 Yes
Application apache hadoop 3.0.0 Yes
Application apache hadoop 3.0.0 Yes
Application apache hadoop 3.0.0 Yes
References