CVE-2017-3161

The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.

• CWE-79

• http://www.securityfocus.com/bid/98025Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/r127f75748fcabc63bc5a1bec6885753eb9b2bed803b6ed7bd46f965b%40%3Cuser.hadoop.apache.org%3E
• https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a%40%3Cuser.flink.apache.org%3E
• https://s.apache.org/4MQmMailing List, Vendor Advisory
• http://www.securityfocus.com/bid/98025Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/r127f75748fcabc63bc5a1bec6885753eb9b2bed803b6ed7bd46f965b%40%3Cuser.hadoop.apache.org%3E
• https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a%40%3Cuser.flink.apache.org%3E
• https://s.apache.org/4MQmMailing List, Vendor Advisory

Published

Apr 26, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-3155Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating …
• CVE-2017-3156The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF p…
• CVE-2017-3157By exploiting the way Apache OpenOffice before 4.1.4 renders…
• CVE-2017-3158A race condition in Guacamole's terminal emulator in version…
• CVE-2017-3159Apache Camel's camel-snakeyaml component is vulnerable to Ja…
• CVE-2017-3160After the Android platform is added to Cordova the first tim…
• CVE-2017-3162HDFS clients interact with a servlet on the DataNode to brow…
• CVE-2017-3163When using the Index Replication feature, Apache Solr nodes …
• CVE-2017-3164Server Side Request Forgery in Apache Solr, versions 1.3 unt…
• CVE-2017-3165In Apache Brooklyn before 0.10.0, the REST server is vulnera…
• CVE-2017-3166In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, an…
• CVE-2017-3167In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26,…9.8