PT-2019-9200 · Cloudera · Cloudera Manager

Ekta Mittal + 1 · Published 2019-06-20 · Updated 2020-08-13 · CVE-2018-15913

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cloudera Manager versions 5.x through 5.15.0

Description An issue in Cloudera Manager allows for potential cross-site scripting (XSS) due to the lack of validation of the returnUrl parameter. This parameter is used to redirect the user to another page in Cloudera Manager after completing a wizard. As a result, an attacker could redirect the user to an external site or execute malicious JavaScript functions. The fix involves restricting the returnUrl parameter to prevent external redirects, with exceptions for explicitly configured SAML Login/Logout URLs.

Recommendations For Cloudera Manager versions 5.x through 5.15.0, update the software to a version that includes the fix, which restricts the returnUrl parameter to prevent external redirects, allowing only explicitly configured SAML Login/Logout URLs as exceptions.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-15913

Affected Products

Cloudera Manager

References · 4

• https://cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html · Vendor Advisory
• https://cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#cloudera_manager · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15913 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15913 · Vendor Advisory