Lucene search

RedhatCVE-2013-6446

HistoryMar 23, 2017 - 8:59 p.m.

CVE-2013-6446

2017-03-2320:59:00

CWE-264

redhat

web.nvd.nist.gov

cloudera

cdh

jobhistory server

mrv2

yarn

http authentication

cve-2013-6446

nvd

security vulnerability

information disclosure

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

3.7

Confidence

High

EPSS

0.001

Percentile

34.9%

JSON

The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows remote authenticated users to obtain sensitive job information by leveraging failure to enforce job ACLs.

Affected configurations

Nvd

Node

clouderacdhMatch4.0.0

clouderacdhMatch4.0.1

clouderacdhMatch4.1.0

clouderacdhMatch4.1.1

clouderacdhMatch4.1.2

clouderacdhMatch4.1.3

clouderacdhMatch4.1.4

clouderacdhMatch4.1.5

clouderacdhMatch4.2.0

clouderacdhMatch4.2.1

clouderacdhMatch4.2.2

clouderacdhMatch4.3.0

clouderacdhMatch4.3.1

clouderacdhMatch4.3.2

clouderacdhMatch4.4.0

clouderacdhMatch4.5.0

clouderacdhMatch5.0.0beta

VendorProductVersionCPE
clouderacdh4.0.0cpe:2.3:a:cloudera:cdh:4.0.0:*:*:*:*:*:*:*
clouderacdh4.0.1cpe:2.3:a:cloudera:cdh:4.0.1:*:*:*:*:*:*:*
clouderacdh4.1.0cpe:2.3:a:cloudera:cdh:4.1.0:*:*:*:*:*:*:*
clouderacdh4.1.1cpe:2.3:a:cloudera:cdh:4.1.1:*:*:*:*:*:*:*
clouderacdh4.1.2cpe:2.3:a:cloudera:cdh:4.1.2:*:*:*:*:*:*:*
clouderacdh4.1.3cpe:2.3:a:cloudera:cdh:4.1.3:*:*:*:*:*:*:*
clouderacdh4.1.4cpe:2.3:a:cloudera:cdh:4.1.4:*:*:*:*:*:*:*
clouderacdh4.1.5cpe:2.3:a:cloudera:cdh:4.1.5:*:*:*:*:*:*:*
clouderacdh4.2.0cpe:2.3:a:cloudera:cdh:4.2.0:*:*:*:*:*:*:*
clouderacdh4.2.1cpe:2.3:a:cloudera:cdh:4.2.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cloudera	cdh	4.0.0	cpe:2.3:a:cloudera:cdh:4.0.0:::::::*
cloudera	cdh	4.0.1	cpe:2.3:a:cloudera:cdh:4.0.1:::::::*
cloudera	cdh	4.1.0	cpe:2.3:a:cloudera:cdh:4.1.0:::::::*
cloudera	cdh	4.1.1	cpe:2.3:a:cloudera:cdh:4.1.1:::::::*
cloudera	cdh	4.1.2	cpe:2.3:a:cloudera:cdh:4.1.2:::::::*
cloudera	cdh	4.1.3	cpe:2.3:a:cloudera:cdh:4.1.3:::::::*
cloudera	cdh	4.1.4	cpe:2.3:a:cloudera:cdh:4.1.4:::::::*
cloudera	cdh	4.1.5	cpe:2.3:a:cloudera:cdh:4.1.5:::::::*
cloudera	cdh	4.2.0	cpe:2.3:a:cloudera:cdh:4.2.0:::::::*
cloudera	cdh	4.2.1	cpe:2.3:a:cloudera:cdh:4.2.1:::::::*

Rows per page:

1-10 of 171

References

www.securityfocus.com/bid/97068

www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_mfb_qpm_4n

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

3.7

Confidence

High

EPSS

0.001

Percentile

34.9%

JSON

Related for CVE-2013-6446