Authentication Flaw in Apache Hadoop WebHDFS Client Leads to Potential Security Risk
CVE-2020-9492
8.8HIGH
What is CVE-2020-9492?
In versions of Apache Hadoop from 3.2.0 to 3.2.1, alongside earlier release candidates and alpha versions, a significant flaw exists in the WebHDFS client. This vulnerability allows an unauthorized SPNEGO authorization header to be transmitted to remote URLs without proper verification, which could inadvertently expose sensitive user credentials. This poses a risk of privilege escalation, impacting overall application security.
Affected Version(s)
Apache Hadoop Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, 2.0.0-alpha to 2.10.0