PT-2017-16641 · Apache · Apache Knox

Publicado 2017-05-26 · Atualizado 2022-05-13 · CVE-2017-5646

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Knox versions 0.2.0 through 0.11.0

Description An authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS through Apache Knox, potentially resulting in escalated privileges and unauthorized data access. Although this activity is audit logged and can be associated with the authenticated user, it is still a serious security issue.

Recommendations For versions 0.2.0 through 0.11.0, upgrade to the Apache Knox 0.12.0 release.

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

Identificadores relacionados

CVE-2017-5646

GHSA-G3FC-8JV4-QMMV

Produtos afetados

Apache Knox

Referências · 11

• https://github.com/apache/knox · Nota
• https://github.com/apache/knox/commit/998dcd257dc839c9651485760da4d614c16e2ca2 · Nota
• https://osv.dev/vulnerability/GHSA-g3fc-8jv4-qmmv · Aviso do Fabricante
• https://lists.apache.org/thread.html/rcd6bcbcc08840d4e4bea661efe9a5ef8f6126ebbbc5bc266701d8f48@%3Cdev.logging.apache.org%3E · Nota
• http://securityfocus.com/bid/98739 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5646 · Nota de Segurança
• https://t.me/cvenotify/5343 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-5646 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rcd6bcbcc08840d4e4bea661efe9a5ef8f6126ebbbc5bc266701d8f48%40%3Cdev.logging.apache.org%3E · Nota
• http://mail-archives.apache.org/mod_mbox/knox-user/201705.mbox/%3CCACRbFyjtT7QQGHUzTRdbJoySbJb7tt4BDk5-r-VRn0GB0Kgvag%40mail.gmail.com%3E · Aviso do Fabricante
• https://t.me/cvenotify/12715 · Publicação no Telegram