Configuration File Exposure in Cloudera Manager by Cloudera
CVE-2015-2263

3.3LOW

Key Information:

Vendor

Cloudera

Status
Cloudera Manager
Vendor
CVE Published:
23 March 2017

What is CVE-2015-2263?

A vulnerability in Cloudera Manager affects versions 4.x and 5.0.x through 5.3.x, allowing local users to exploit global read permissions for files in the configuration directory when YARN NodeManager starts. This misconfiguration permits access to sensitive information, such as yarn.keytab or ssl-server.xml, compromising the security of the application and potentially exposing critical credentials.

References

https://www.cloudera.com/documentation/other/security-bul...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.