vulnwire
6.5med

CVE-2017-15713

Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main

Also known as GHSA-3v44-382q-55f4

Published 8 y ago · modified 4 mo ago · JSON

CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.2%
percentile 83%
Public exploits
0
none known

Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.

Exploit prediction (EPSS)

2.21% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD2.04.0AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub3.06.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.hadoop:hadoop-main
<2.7.5
>=2.8.0, <2.8.3
2.7.5
2.8.3

Affected products

  • Apache Software Foundation Apache Hadoop

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • lists.apache.org /thread.html/a790a251ace7213bde9f69777dedb453b1a01a6d18289c14a61d4f91%40%3Cgeneral.hadoop. · mailing-list, x_refsource_MLIST, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-15713 · advisory
  • github.com /advisories/GHSA-3v44-382q-55f4 · advisory
  • lists.apache.org /thread.html/a790a251ace7213bde9f69777dedb453b1a01a6d18289c14a61d4f91@%3Cgeneral.hadoop.ap · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.