cloudera vulnerabilities

Products

• cloudera manager 22
• cdh 11
• hue 6
• data science workbench 5
• manager 3
• data engineering 2
• cloudera cdh 1
• cloudera service and configuration manager 1
• hadoop 1
• key trustee server 1
• navigator 1
• navigator key trustee kms 1

Latest cloudera CVEs

Newest publication first · page 1 of 3

1. CVE-2025-3884 Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability

   Published 2025-05-22

   High·CVSS 7.5 EPSS 1.8%

   Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cloudera Hue. Authentication is not required to exploit this vulnerability. The specific fla...

2. CVE-2021-32483 Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard.

   Published 2021-11-08

   Medium·CVSS 5.3 EPSS 0.80%

   Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard.

3. CVE-2021-30132 Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.

   Published 2021-11-08

   Critical·CVSS 9.8 EPSS 1.1%

   Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.

4. CVE-2021-29243 Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS.

   Published 2021-11-08

   Medium·CVSS 6.1 EPSS 0.59%

   Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS.

5. CVE-2021-32482 Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter.

   Published 2021-11-08

   Medium·CVSS 6.1 EPSS 0.59%

   Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter.

6. CVE-2021-29994 Cloudera Hue 4.6.0 allows XSS.

   Published 2021-11-08

   Medium·CVSS 6.1 EPSS 0.90%

   Cloudera Hue 4.6.0 allows XSS.

7. CVE-2021-32481 Cloudera Hue 4.6.0 allows XSS via the type parameter.

   Published 2021-11-08

   Medium·CVSS 6.1 EPSS 0.67%

   Cloudera Hue 4.6.0 allows XSS via the type parameter.

8. CVE-2021-3167 In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs.

   Published 2021-03-15

   Medium·CVSS 6.5 EPSS 1.1%

   In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs.

9. CVE-2020-26936 Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.

   Published 2020-11-26

   High·CVSS 8.8 EPSS 0.45%

   Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.

10. CVE-2019-14449 An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this pro...

    Published 2019-11-26

    Medium·CVSS 5.4 EPSS 0.52%

    An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this product.

11. CVE-2016-9271 Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.

    Published 2019-11-26

    Medium·CVSS 5.4 EPSS 0.52%

    Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.

12. CVE-2017-7399 Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those....

    Published 2019-11-26

    High·CVSS 8.8 EPSS 0.86%

    Cloudera Manager 5.8.x before 5.8.5, 5.9.x before 5.9.2, and 5.10.x before 5.10.1 allows a read-only Cloudera Manager user to discover the usernames of other users and elevate the privileges of those users.

13. CVE-2019-7319 An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, SpnegoDjangoBackend, RemoteUserDjangoBackend, SAML2Backend, O...

    Published 2019-11-26

    High·CVSS 8.3 EPSS 1.0%

    An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, SpnegoDjangoBackend, RemoteUserDjangoBackend, SAML2Backend, OpenIDBackend, or OAuthBackend, external users are created with superuser privile...

14. CVE-2018-20090 An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. Authenticated users can bypass project permission checks and gain read-write access to any project folder.

    Published 2019-11-26

    High·CVSS 8.3 EPSS 0.83%

    An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. Authenticated users can bypass project permission checks and gain read-write access to any project folder.

15. CVE-2018-17860 Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1.

    Published 2019-11-26

    High·CVSS 7.2 EPSS 0.95%

    Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1.

16. CVE-2015-4457 Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors.

    Published 2019-11-26

    Medium·CVSS 5.4 EPSS 0.62%

    Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors.

17. CVE-2015-6495 There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.

    Published 2019-11-26

    High·CVSS 7.5 EPSS 1.1%

    There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.

18. CVE-2015-7831 In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.

    Published 2019-11-26

    High·CVSS 8.8 EPSS 1.1%

    In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.

19. CVE-2016-3131 Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls.

    Published 2019-11-26

    Medium·CVSS 6.5 EPSS 0.67%

    Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls.

20. CVE-2016-3192 Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files.

    Published 2019-11-26

    Medium·CVSS 6.5 EPSS 0.61%

    Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files.

21. CVE-2016-4572 In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges.

    Published 2019-11-26

    High·CVSS 8.8 EPSS 0.86%

    In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges.

22. CVE-2016-5724 Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles.

    Published 2019-11-26

    High·CVSS 7.5 EPSS 1.2%

    Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles.

23. CVE-2016-6353 Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the RealTimeGetHandler.

    Published 2019-11-26

    Medium·CVSS 6.5 EPSS 0.75%

    Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the RealTimeGetHandler.

24. CVE-2018-11744 Cloudera Manager through 5.15 has Incorrect Access Control.

    Published 2019-07-11

    High·CVSS 8.1 EPSS 0.93%

    Cloudera Manager through 5.15 has Incorrect Access Control.

25. CVE-2017-9325 The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs.

    Published 2019-07-03

    High·CVSS 7.5 EPSS 0.83%

    The provided secure solrconfig.xml sample configuration does not enforce Sentry authorization on /update/json/docs.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.