« Volver al listado

CVE-2016-5393

Estado: ModificadaAlta (8.8)—

In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Hadoop

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-5393",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Apache Hadoop",
          "versions": [
            {
              "status": "affected",
              "version": "Apache Hadoop 2.6.x before 2.6.5, 2.7.x before 2.7.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-11-29T06:59:00.177",
  "references": [
    {
      "url": "http://mail-archives.apache.org/mod_mbox/hadoop-general/201611.mbox/%3CCAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q%40mail.gmail.com%3E",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/94574",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://mail-archives.apache.org/mod_mbox/hadoop-general/201611.mbox/%3CCAA0W1bTbUmUUSF1rjRpX-2DvWutcrPt7TJSWUcSLg1F0gyHG1Q%40mail.gmail.com%3E",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/94574",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service."
    },
    {
      "lang": "es",
      "value": "En Apache Hadoop 2.6.x en versiones anteriores a 2.6.5 y 2.7.x en versiones anteriores a 2.7.3, un usuario remoto que pueda autentificarse con el HDFS NameNode podría posiblemente ejecutar comandos arbitrarios con los mismos privilegios que el servicio HDFS."
    }
  ],
  "lastModified": "2026-06-17T00:49:19.763",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:hadoop:2.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00E1BC92-93DF-479F-8C05-672ADF348565"
            },
            {
              "criteria": "cpe:2.3:a:apache:hadoop:2.7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0CACFCC5-8A44-4DAE-A83F-139B488509A4"
            },
            {
              "criteria": "cpe:2.3:a:apache:hadoop:2.7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BE605CB-8A00-45EC-9DAA-775D4E9F5B85"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:hadoop:2.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25EA1A6B-46EF-4157-854A-8991158D8A56"
            },
            {
              "criteria": "cpe:2.3:a:apache:hadoop:2.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "569A25D2-6BAE-4AF3-B5A4-E578F5BF4000"
            },
            {
              "criteria": "cpe:2.3:a:apache:hadoop:2.6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0303DDA4-A5C1-4358-A4DC-F85C1B2E3254"
            },
            {
              "criteria": "cpe:2.3:a:apache:hadoop:2.6.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68F54CBB-0D44-4F8F-A45D-330213E0C349"
            },
            {
              "criteria": "cpe:2.3:a:apache:hadoop:2.6.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97B60011-6E60-4DBC-957B-C1F1CBB2B777"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}