Vulnerability Details CVE-2021-3167
In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 60.3%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 4.0
References
- https://docs.cloudera.com/data-engineering/cloud/release-notes/topics/cde-general-known-issues.html
- https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html
- https://my.cloudera.com/knowledge/TSB-2021-466-CDE-authentication-tokens-exposed-in-pod-and?id=310163
- https://docs.cloudera.com/data-engineering/cloud/release-notes/topics/cde-general-known-issues.html
- https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html
- https://my.cloudera.com/knowledge/TSB-2021-466-CDE-authentication-tokens-exposed-in-pod-and?id=310163
Products affected by CVE-2021-3167
-
cpe:2.3:a:cloudera:data_engineering:1.3.0