PT-2019-9985 · Cloudera · Cloudera Data Science Workbench

Milan Magyar · Published 2019-06-07 · Updated 2019-06-10 · CVE-2018-20091

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloudera Data Science Workbench versions 1.4.0 through 1.4.2

Description An SQL injection issue was found, allowing any authenticated user to run arbitrary queries against the internal database. This database contains user contact information, encrypted passwords, API keys, and stored Kerberos keytabs.

Recommendations For Cloudera Data Science Workbench versions 1.4.0 through 1.4.2, consider restricting access to the internal database to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of authenticated users to prevent them from running arbitrary queries against the database.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-20091

Affected Products

Cloudera Data Science Workbench

References · 5

• https://osv.dev/vulnerability/CVE-2018-20091 · Vendor Advisory
• https://cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html · Vendor Advisory
• https://cloudera.com/products/data-science-and-engineering/data-science-workbench.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20091 · Security Note
• https://t.me/cibsecurity/4762 · Telegram Post