cbcvebase.
CVE-2014-0229
published 2017-03-23

CVE-2014-0229: Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes…

PriorityP431medium6.5CVSS 3.0
AVNACLPRLUINSUCNINAH
EPSS
1.59%
73.1th percentile
Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service (DataNodes shutdown) or perform unnecessary operations by issuing a command.

Affected

23 ranges
VendorProductVersion rangeFixed in
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
apachehadoop——
clouderacdh——

CVSS provenance

nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.