Description

Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.

Remediation

References

https://lists.apache.org/thread.html/r790ad0a049cde713b93589ecfd4dd2766fda0fc6807eedb6cf69f5c1%40%3Cgeneral.hadoop.apache.org%3E

https://security.netapp.com/advisory/ntap-20201103-0003/

Related Vulnerabilities

CVE-2022-43413 Vulnerability in maven package org.jenkins-ci.plugins:job-import-plugin

CVE-2020-14446 Vulnerability in maven package org.wso2.carbon.identity.framework:org.wso2.carbon.policyeditor.ui

CVE-2022-28220 Vulnerability in maven package org.apache.james.protocols:protocols-netty

CVE-2023-22467 Vulnerability in npm package luxon

CVE-2022-41251 Vulnerability in maven package org.jenkins-ci.plugins:apprenda

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Vendor Advisory Third Party Advisory CWE-306