JNDI Injection Vulnerability in Cloudera JDBC Connector for Hive and Impala
CVE-2024-54660

8.7HIGH

Key Information:

Vendor

Cloudera

Status
JDBC Connector for Hive and Impala
Vendor
CVE Published:
16 January 2025

What is CVE-2024-54660?

A JNDI injection vulnerability allows attackers to manipulate JDBC URL parameters, exploiting the JDBC Driver's connection process. Specifically, untrusted input in the krbJAASFile property can initiate JNDI injection, potentially leading to remote code execution. This highlights the risks associated with improper handling of JDBC connection properties in Cloudera's JDBC Connector for Hive and Impala, underscoring the critical importance of secure coding practices.

References

https://www.blackhat.com/eu-24/briefings/schedule/index.h...

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.