NVD

Id
85932  
Name
CVE-2017-5646  
Description
For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS through Apache Knox. This may result in escalated privileges and unauthorized data access. While this activity is audit logged and can be easily associated with the authenticated user, this is still a serious security issue. All users are recommended to upgrade to the Apache Knox 0.12.0 release.  
Reject
 
CVSS Version
2  
CVSS Score
4.9  
Severity
Medium  
CVSS Base Score
4.9  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:N)  
Pub Date
2017-06-12  
Published
2017-05-26  
Modified Date
2017-06-08  
Seq
2017-5646  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
422575 85932 CVE-2017-0331 98150  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
68283 JVNDB-2017-004540 Apache Knox における同一生成元ポリシー違反に関する脆弱性 Apache Knox には、同一生成元ポリシー違反に関する脆弱性が存在します。 CVE-2017-5646 0 CVE-2017-5646 85932 4.9 6.8 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-004540.html 2017-05-26 2017-06-28 View