Vulnerability Details CVE-2018-15804
An issue was discovered in the MapR File System in MapR Converged Data Platform and MapR-XD 6.x and earlier. Under certain conditions, it is possible for MapR ticket credentials to become compromised, allowing a user to escalate their privileges to act as (aka impersonate) any other user, including cluster administrators, aka bug# 31935. This affects all users who have enabled security on the MapR platform and is fixed in mapr-patch-5.2.1.42646.GA-20180731093831, mapr-patch-5.2.2.44680.GA-20180802011430, mapr-patch-6.0.0.20171109191718.GA-20180802011420, and mapr-patch-6.0.1.20180404222005.GA-20180806214919.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 54.2%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 4.0
References
Products affected by CVE-2018-15804
-
cpe:2.3:a:mapr:mapr:2.0.0
-
cpe:2.3:a:mapr:mapr:2.0.1
-
cpe:2.3:a:mapr:mapr:2.1.0
-
cpe:2.3:a:mapr:mapr:2.1.1
-
cpe:2.3:a:mapr:mapr:2.1.2
-
cpe:2.3:a:mapr:mapr:2.1.3
-
cpe:2.3:a:mapr:mapr:2.1.3.2
-
cpe:2.3:a:mapr:mapr:3.0.1
-
cpe:2.3:a:mapr:mapr:3.0.2
-
cpe:2.3:a:mapr:mapr:3.0.3
-
cpe:2.3:a:mapr:mapr:3.1.0
-
cpe:2.3:a:mapr:mapr:3.1.1
-
cpe:2.3:a:mapr:mapr:4.0.0
-
cpe:2.3:a:mapr:mapr:4.0.1
-
cpe:2.3:a:mapr:mapr:4.0.2
-
cpe:2.3:a:mapr:mapr:4.1.0
-
cpe:2.3:a:mapr:mapr:5.0.0
-
cpe:2.3:a:mapr:mapr:5.1.0
-
cpe:2.3:a:mapr:mapr:5.2.0
-
cpe:2.3:a:mapr:mapr:5.2.1
-
cpe:2.3:a:mapr:mapr:5.2.2
-
cpe:2.3:a:mapr:mapr:6.0.0