User Enumeration Vulnerability in Cloudera HUE by Cloudera
CVE-2016-4947

5.3MEDIUM

Key Information:

Vendor

Cloudera

Status
Hue
Vendor
CVE Published:
7 March 2017

What is CVE-2016-4947?

Cloudera HUE versions 3.9.0 and earlier are susceptible to a user enumeration vulnerability that allows remote attackers to illicitly discover user accounts through specifically crafted API requests directed at the endpoint desktop/api/users/autocomplete. This flaw can lead to unauthorized access and information disclosure, potentially enabling attackers to launch further targeted attacks against identified users.

References

http://2016.hack.lu/archive/2016/Wavestone%20-%20Hack.lu%...
x_refsource_MISC
http://www.securityfocus.com/bid/93880
vdb-entryx_refsource_BID

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2016-4947 : User Enumeration Vulnerability in Cloudera HUE by Cloudera