PT-2019-9200 · Cloudera · Cloudera Manager

Ekta Mittal + 1 · Publicado 2019-06-20 · Atualizado 2020-08-13 · CVE-2018-15913

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cloudera Manager versions 5.x through 5.15.0

Description An issue in Cloudera Manager allows for potential cross-site scripting (XSS) due to the lack of validation of the returnUrl parameter. This parameter is used to redirect the user to another page in Cloudera Manager after completing a wizard. As a result, an attacker could redirect the user to an external site or execute malicious JavaScript functions. The fix involves restricting the returnUrl parameter to prevent external redirects, with exceptions for explicitly configured SAML Login/Logout URLs.

Recommendations For Cloudera Manager versions 5.x through 5.15.0, update the software to a version that includes the fix, which restricts the returnUrl parameter to prevent external redirects, allowing only explicitly configured SAML Login/Logout URLs as exceptions.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-15913

Produtos afetados

Cloudera Manager

Referências · 4

• https://cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html · Aviso do Fabricante
• https://cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#cloudera_manager · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-15913 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-15913 · Aviso do Fabricante