Strix
26.1K

CVE-2017-15713

UnknownEPSS 2.25%

Last modified

CVE-2017-15713 is a vulnerability of currently unknown severity. Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.. EPSS estimates a 2.25% chance of exploitation in the next 30 days.

Description

Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.

Metrics

EPSS Probability
2.25%

80.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
ApacheHadoop>= 0.23.0, <= 0.23.11—
ApacheHadoop>= 2.2.0, <= 2.8.2—
ApacheHadoop2.0.0Alpha
ApacheHadoop2.0.1Alpha
ApacheHadoop2.0.2Alpha
ApacheHadoop2.0.3Alpha
ApacheHadoop2.0.4Alpha
ApacheHadoop2.0.5Alpha
ApacheHadoop2.0.6Alpha
ApacheHadoop2.1.0Beta
ApacheHadoop2.1.1Beta
ApacheHadoop3.0.0Alpha1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2017-15713?
Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.
How severe is CVE-2017-15713?
Severity scoring for CVE-2017-15713 is pending analysis. The EPSS model estimates a 2.25% probability of exploitation in the next 30 days.
How do I fix CVE-2017-15713?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-15713?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST