CVE-2016-4949

High

Published: 07/03/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a stderr.log or stdout.log value in the filename parameter to /cmf/process/<process_id>/logs.

Risk Assessment

Attackers may gain access to sensitive data, potentially leading to further attacks on the system or information leakage.

Recommendation

It is recommended to update Cloudera Manager to the latest version and restrict access to logs to authorized users.

Other vulnerabilities in Cloudera Manager

CVE-2016-4950High
Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions.

Original NVD description (English source)

Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) stdout.log value in the filename parameter to /cmf/process/<process_id>/logs.