PT-2019-9985 · Cloudera · Cloudera Data Science Workbench

Milan Magyar · Publicado 2019-06-07 · Atualizado 2019-06-10 · CVE-2018-20091

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloudera Data Science Workbench versions 1.4.0 through 1.4.2

Description An SQL injection issue was found, allowing any authenticated user to run arbitrary queries against the internal database. This database contains user contact information, encrypted passwords, API keys, and stored Kerberos keytabs.

Recommendations For Cloudera Data Science Workbench versions 1.4.0 through 1.4.2, consider restricting access to the internal database to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of authenticated users to prevent them from running arbitrary queries against the database.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-20091

Produtos afetados

Cloudera Data Science Workbench

Referências · 5

• https://osv.dev/vulnerability/CVE-2018-20091 · Aviso do Fabricante
• https://t.me/cibsecurity/4762 · Publicação no Telegram
• https://cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html · Aviso do Fabricante
• https://cloudera.com/products/data-science-and-engineering/data-science-workbench.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-20091 · Nota de Segurança