CVE-2018-8042
UnknownEPSS 1.75%
Last modified
CVE-2018-8042 is a vulnerability of currently unknown severity. Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie.. EPSS estimates a 1.75% chance of exploitation in the next 30 days.
Description
Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Ambari | >= 2.5.0, <= 2.6.2 |
References
- http://www.securityfocus.com/bid/104869Broken Link
- http://www.securityfocus.com/bid/104869Broken Link
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-8042?
Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie.
How severe is CVE-2018-8042?
Severity scoring for CVE-2018-8042 is pending analysis. The EPSS model estimates a 1.75% probability of exploitation in the next 30 days.
How do I fix CVE-2018-8042?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-8036In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a c…
- CVE-2018-8037If an async request was completed by the application at the …
- CVE-2018-8038Versions of Apache CXF Fediz prior to 1.4.4 do not fully dis…
- CVE-2018-8039It is possible to configure Apache CXF to use the com.sun.ne…
- CVE-2018-8040Pages that are rendered using the ESI plugin can have access…
- CVE-2018-8041Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.…
- CVE-2018-8043The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-u…
- CVE-2018-8044K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affecte…7.8
- CVE-2018-8045In Joomla! 3.5.0 through 3.8.5, the lack of type casting of …
- CVE-2018-8046The getTip() method of Action Columns of Sencha Ext JS 4 to …
- CVE-2018-8047vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scr…
- CVE-2018-8048In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HT…
Are you affected by CVE-2018-8042?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST