CVE-2015-1836

High

Published: 21/12/2015(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Apache HBase versions before 0.98.12.1, 1.0.1.1, and 1.1.0.1, as used in IBM InfoSphere BigInsights, have incorrect ACLs for ZooKeeper coordination state. This allows remote attackers to cause a denial of service, obtain sensitive information, or modify data via unspecified client traffic.

Risk Assessment

Organizations may be exposed to attacks that lead to service outages, data disclosure, or unauthorized data modification.

Recommendation

It is recommended to upgrade Apache HBase to the latest version to mitigate this vulnerability and review the ACL configuration for ZooKeeper.

Other vulnerabilities in Apache HBase

CVE-2026-49326Medium
In Apache HBase, the thrift and REST services lack owner authorization in scanner fetch and close operations. A user can fetch rows from scanners opened by other users and close scanners belonging to others, breaking data isolation.

Original NVD description (English source)

Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.