PT-2017-16641 · Apache · Apache Knox

Published 2017-05-26 · Updated 2022-05-13 · CVE-2017-5646

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Knox versions 0.2.0 through 0.11.0

Description An authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS through Apache Knox, potentially resulting in escalated privileges and unauthorized data access. Although this activity is audit logged and can be associated with the authenticated user, it is still a serious security issue.

Recommendations For versions 0.2.0 through 0.11.0, upgrade to the Apache Knox 0.12.0 release.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2017-5646

GHSA-G3FC-8JV4-QMMV

Affected Products

Apache Knox

References · 11

• https://osv.dev/vulnerability/GHSA-g3fc-8jv4-qmmv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5646 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5646 · Vendor Advisory
• http://mail-archives.apache.org/mod_mbox/knox-user/201705.mbox/%3CCACRbFyjtT7QQGHUzTRdbJoySbJb7tt4BDk5-r-VRn0GB0Kgvag%40mail.gmail.com%3E · Vendor Advisory
• https://github.com/apache/knox · Note
• https://github.com/apache/knox/commit/998dcd257dc839c9651485760da4d614c16e2ca2 · Note
• https://lists.apache.org/thread.html/rcd6bcbcc08840d4e4bea661efe9a5ef8f6126ebbbc5bc266701d8f48@%3Cdev.logging.apache.org%3E · Note
• http://securityfocus.com/bid/98739 · Note
• https://t.me/cvenotify/5343 · Telegram Post
• https://lists.apache.org/thread.html/rcd6bcbcc08840d4e4bea661efe9a5ef8f6126ebbbc5bc266701d8f48%40%3Cdev.logging.apache.org%3E · Note
• https://t.me/cvenotify/12715 · Telegram Post