CM
Product
Cloudera Manager
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 4Medium 12Low 2
Watch
Add Cloudera Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-30132 | 9.8 | Nov 8 | Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges Affected: 7.2.4 |
| CVE-2017-7399 | 8.8 | Nov 26 | Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the… Affected: 5.0.0 through 5.0.7; 5.1.0 through 5.1.6; 5.2.0 through 5.2.7; 5.3.0 through 5.3.10; 5.4.0 through 5.4.3; 5.4.5 through 5.4.10; +6 more |
| CVE-2018-11744 | 8.1 | Jul 11 | Cloudera Manager through 5.15 has Incorrect Access Control Affected: through 5.16; 6.0.0 through 6.1.0 |
| CVE-2015-6495 | 7.5 | Nov 26 | There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles Affected: before 4.8.6; 5.0.0 before 5.0.7; 5.1.0 before 5.1.6; 5.2.0 before 5.2.7; 5.3.0 before 5.3.7; 5.4.0 before 5.4.6 |
| CVE-2017-9326 | 7.5 | Jul 3 | The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed by Cloudera Manager Affected: 5.11.0 |
| CVE-2016-3192 | 6.5 | Nov 26 | Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files Affected: 5.0.0 before 5.5.4; 5.6.0 before 5.6.1; 5.7.0 before 5.7.1 |
| CVE-2017-9327 | 6.5 | Jul 3 | Secret data of processes managed by CM is not secured by file permissions Affected: 5.9.2; 5.10.1; 5.11.0 |
| CVE-2018-10815 | 6.5 | May 24 | An issue was discovered in Cloudera Manager before 5.13.4, 5.14.x before 5.14.4, and 5.15.x before 5.15.1 Affected: before 5.13.4; 5.14.0 before 5.14.4; 5.15.0 before 5.15.1 |
| CVE-2021-32482 | 6.1 | Nov 8 | Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter Affected: 5.0.0 through 5.16.2; 6.0.0 through 6.3.4; 7.1.0 through 7.1.4; 7.2.0 through 7.2.4; 7.3.0 through 7.3.4 |
| CVE-2021-29243 | 6.1 | Nov 8 | Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS Affected: 5.0.0 through 5.16.2; 6.0.0 through 6.3.4; 7.1.0 through 7.1.4; 7.2.0 through 7.2.4; 7.3.0 through 7.3.4 |
| CVE-2018-15913 | 6.1 | Jun 20 | An issue was discovered in Cloudera Manager 5.x through 5.15.0 Affected: 5.0.0 through 5.15.0 |
| CVE-2018-5798 | 6.1 | Jun 7 | This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager Affected: before 5.12; 5.12; 5.12.1; 5.12.2; 5.13; 5.13.1; +2 more |
| CVE-2019-14449 | 5.4 | Nov 26 | An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1 Affected: 5.0.0 before 5.16.2; 6.0.0; 6.0.1; 6.1.0 |
| CVE-2016-9271 | 5.4 | Nov 26 | Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature Affected: 5.0.0 through 5.0.7; 5.1.0 through 5.1.6; 5.2.0 through 5.2.7; 5.3.0 through 5.3.10; 5.4.0 through 5.4.3; 5.4.5 through 5.4.10; +5 more |
| CVE-2015-4457 | 5.4 | Nov 26 | Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using… Affected: before 5.4.3 |
| CVE-2021-32483 | 5.3 | Nov 8 | Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard Affected: 7.2.4 |
| CVE-2018-6185 | 4.9 | Jun 7 | In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys Affected: 5.12.0; 5.12.1; 5.12.2; 5.13.0; 5.13.1 |
| CVE-2015-2263 | 3.3 | Mar 23 | Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.1.0; +34 more |
| CVE-2015-4078 | 3.1 | Mar 23 | Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to… Affected: 5.3.0; 5.3.1; 5.3.2; 5.3.3; 5.4.0; 5.4.1 |
| CVE-2014-8733 | – | Feb 10 | Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in unspecified world-readable files under /etc/hadoop, which allows local users to obtain this… Affected: 5.2.0; 5.2.1; 5.3.0 |
| CVE-2014-0220 | – | Jun 10 | Cloudera Manager before 4.8.3 and 5.x before 5.0.1 allows remote authenticated users to obtain sensitive configuration information via the API Affected: through 4.8.2; 4.0.1; 4.0.2; 4.0.3; 4.1; 4.1.1; +15 more |
| CVE-2012-2230 | – | Apr 12 | Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote… Affected: 3.7.0; 3.7.0; 3.7.1; 3.7.1; 3.7.2; 3.7.2; +4 more |
Showing 22