CVE-2016-4948 Information

Description

Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Template Name field when renaming a template; (2) KDC Server host (3) Kerberos Security Realm (4) Kerberos Encryption Types (5) Advanced Configuration Snippet (Safety Valve) for [libdefaults] section of krb5.conf (6) Advanced Configuration Snippet (Safety Valve) for the Default Realm in krb5.conf (7) Advanced Configuration Snippet (Safety Valve) for remaining krb5.conf or (8) Active Directory Account Prefix fields in the Kerberos wizard; or (9) classicWizard parameter to cmf/cloudera-director/redirect.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

http://2016.hack.lu/archive/2016/Wavestone20-20Hack.lu20201620-20Hadoop20safari20-20Hunting20for20vulnerabilities20-20v1.0.pdf http://www.securityfocus.com/bid/93878

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

6.1