VulnerabilityModified
CVE-2012-2230
Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote authenticated users to impersonate arbitrary user accounts via unspecified…
MEDIUM 6.5EPSS 1.87%
Does this matter?
Lower severity and a low EPSS score (1.87%). Track it; it rarely justifies an emergency change on its own.
Description
Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote authenticated users to impersonate arbitrary user accounts via unspecified vectors, a different vulnerability than CVE-2012-1574.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 1.87% probability · 78th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- cloudera/cloudera manager · cloudera/cloudera service and configuration manager
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/48776
- https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74823
- http://secunia.com/advisories/48776
- https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74823
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.