Vulnerability Details CVE-2016-5393
In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.026
EPSS Ranking 84.9%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
- http://mail-archives.apache.org/mod_mbox/hadoop-general/201611.mbox/%3CCAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q%40mail.gmail.com%3E
- http://www.securityfocus.com/bid/94574
- http://mail-archives.apache.org/mod_mbox/hadoop-general/201611.mbox/%3CCAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q%40mail.gmail.com%3E
- http://www.securityfocus.com/bid/94574
Products affected by CVE-2016-5393
-
cpe:2.3:a:apache:hadoop:2.6.0
-
cpe:2.3:a:apache:hadoop:2.6.1
-
cpe:2.3:a:apache:hadoop:2.6.2
-
cpe:2.3:a:apache:hadoop:2.6.3
-
cpe:2.3:a:apache:hadoop:2.6.4
-
cpe:2.3:a:apache:hadoop:2.7.0
-
cpe:2.3:a:apache:hadoop:2.7.1
-
cpe:2.3:a:apache:hadoop:2.7.2