Medium severity · published Mar 7, 2017
CVE-2016-4946
Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) First name or (2)…
6.1
CVSS
0.9%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) First name or (2) Last name field in the HUE Users page.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HU
Hue · Cloudera
through 3.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4946
Third Party Advisory
http://2016.hack.lu/archive/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf
www.securityfocus.com
http://www.securityfocus.com/bid/93881
More from Hue
7.5
CVE-2025-3884
Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability
6.1
CVE-2021-32481
Cloudera Hue 4.6.0 allows XSS via the type parameter
6.1
CVE-2021-29994
Cloudera Hue 4.6.0 allows XSS
6.1
CVE-2015-8094
Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next…
5.3
CVE-2016-4947
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete