Authorization Bypass Vulnerability in Apache Hadoop by Cloudera
CVE-2014-0229

6.5MEDIUM

Key Information:

Vendor

Cloudera

Status
Cdh
Vendor
CVE Published:
23 March 2017

What is CVE-2014-0229?

An authorization bypass vulnerability exists in Apache Hadoop versions prior to 0.23.11 and 2.4.1, as utilized by Cloudera CDH 5.0.x before 5.0.2. This flaw allows remote authenticated users to execute admin commands like refreshNamenodes, deleteBlockPool, and shutdownDatanode without proper authorization checks. Consequently, this can lead to service disruptions and unauthorized operations within Hadoop's HDFS, posing significant risks to data integrity and availability.

References

https://www.cloudera.com/documentation/other/security-bul...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.