« Volver al listado

CVE-2013-6446

Estado: ModificadaBaja (3.1)—

The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows remote authenticated users to obtain sensitive job information by leveraging failure to enforce job ACLs.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cloudera — CDH

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-6446",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 3.1,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-03-23T20:59:00.173",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/97068",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_mfb_qpm_4n",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/97068",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_mfb_qpm_4n",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The JobHistory Server in Cloudera CDH 4.x before 4.6.0 and 5.x before 5.0.0 Beta 2, when using MRv2/YARN with HTTP authentication, allows remote authenticated users to obtain sensitive job information by leveraging failure to enforce job ACLs."
    },
    {
      "lang": "es",
      "value": "El JobHistory Server en Cloudera CDH 4.x en versiones anteriores a 4.6.0 y 5.x en versiones anteriores a 5.0.0 Beta 2, cuando se utiliza MRv2/YARN con autenticación HTTP, permite a usuarios remotos autenticados obtener información de trabajo sensible aprovechando el fallo para aplicar ACLs de trabajo."
    }
  ],
  "lastModified": "2026-06-17T00:00:30.490",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30715E47-3508-4413-9AF0-F7A5494BD3DB"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12AFC1A8-B5C1-4704-9208-66A7C58AFF66"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D6CA009-5032-4FE5-8BE6-D00C7DFEB162"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C243346-5F50-4C18-9DAE-A5828BA7DC3D"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D790D3B1-14A3-48D7-BA84-596D00F0793F"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A10C11CC-2C96-4CF0-BC66-7C5A9425A20A"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6718CB4-3D73-4E4F-B54C-EBF944D73352"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE609BC8-D73F-4032-AA71-E5F64910A2B7"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "935C3F63-BF05-4D0C-8C0A-55A8E5AFF8E0"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5A293DE-E885-4BCA-9807-AFEFFE33AC41"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA74529E-7E6B-410C-96E0-6437C7D674C3"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C9EFF66-7D5E-4E2B-AA8C-B75E4EACF6CD"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F33CA6D5-3BE7-4385-B67D-D983DFD0CBC5"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "031729AF-F9E6-479D-90FE-FA7C1E33104F"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9F8B080-BF55-4B31-B122-6F3C64C75ADD"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:4.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCAA7878-70CE-470C-8889-CB13A71FC2ED"
            },
            {
              "criteria": "cpe:2.3:a:cloudera:cdh:5.0.0:beta:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0293F82-7BA9-4608-96B7-CCED9A98313C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}