Medium severity · published Nov 26, 2019
CVE-2019-14449
An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Cloudera Manager · Cloudera
5.0.0 before 5.16.2; 6.0.0; 6.0.1; 6.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14449
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14449
Vendor Advisory
https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#concept_sky_fq1_cjb
More from Cloudera Manager
9.8
CVE-2021-30132
Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges
8.8
CVE-2017-7399
Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the…
8.1
CVE-2018-11744
Cloudera Manager through 5.15 has Incorrect Access Control
7.5
CVE-2015-6495
There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles
7.5
CVE-2017-9326
The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed by Cloudera Manager