GitHub Advisoryadvisory · Maven

GHSA-7q56-mp4c-gggg Improper Access Control in Apache Hadoop

HIGH Published 2022-05-17 Modified 2022-07-06 Official page ↗
Aliases
CVE-2016-5393
Ecosystem
Maven
Packages
org.apache.hadoop:hadoop-common
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2022-07-06

Affected packages

• Maven org.apache.hadoop:hadoop-common: >= 2.6.0, < 2.6.5 → fixed in 2.6.5 • Maven org.apache.hadoop:hadoop-common: >= 2.7.0, < 2.7.3 → fixed in 2.7.3

Description

In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.

Related

Alias · CVE (1)

  • CVE-2016-5393 In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References