FKIE_CVE-2018-20091

Vulnerability from fkie_nvd - Published: 2019-06-07 16:29 - Updated: 2024-11-21 04:00
Severity ?
9.9 (Critical) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. This would allow any authenticated user to run arbitrary queries against CDSW's internal database. The database contains user contact information, encrypted CDSW passwords (in the case of local authentication), API keys, and stored Kerberos keytabs.
References
cve@mitre.orghttps://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.htmlPatch, Vendor Advisory
cve@mitre.orghttps://www.cloudera.com/products/data-science-and-engineering/data-science-workbench.htmlProduct, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.cloudera.com/products/data-science-and-engineering/data-science-workbench.htmlProduct, Vendor Advisory
Impacted products
Vendor Product Version
cloudera data_science_workbench *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cloudera:data_science_workbench:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2D96E42-3F76-43AA-9659-4A354BDA90C3",
              "versionEndIncluding": "1.4.2",
              "versionStartIncluding": "1.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. This would allow any authenticated user to run arbitrary queries against CDSW\u0027s internal database. The database contains user contact information, encrypted CDSW passwords (in the case of local authentication), API keys, and stored Kerberos keytabs."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 una vulnerabilidad de inyecci\u00f3n SQL en Cloudera Data Science Workbench (CDSW) versi\u00f3n 1.4.0 hasta la versi\u00f3n 1.4.2. Esto permitir\u00eda a cualquier usuario autenticado ejecutar consultas arbitrarias en la base de datos interna de CDSW. La base de datos contiene informaci\u00f3n de contacto del usuario, contrase\u00f1as cifradas de CDSW (en el caso de la autenticaci\u00f3n local), claves de API y fichas de claves de Kerberos almacenadas."
    }
  ],
  "id": "CVE-2018-20091",
  "lastModified": "2024-11-21T04:00:51.380",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-06-07T16:29:00.330",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "url": "https://www.cloudera.com/products/data-science-and-engineering/data-science-workbench.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "url": "https://www.cloudera.com/products/data-science-and-engineering/data-science-workbench.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.