Vulnerabilities > CVE-2016-6353 - Incorrect Authorization vulnerability in Cloudera CDH

CVSS 3.5 - LOW

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

cloudera

CWE-863

NVD

Published: 2019-11-26

Updated: 2019-12-12

Summary

Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the RealTimeGetHandler.

Vulnerable Configurations

Part	Description	Count
Application	Cloudera Cloudera CDH 5.0.0 Cloudera CDH 5.0.1 Cloudera CDH 5.1.0 Cloudera CDH 5.1.2 Cloudera CDH 5.1.3 Cloudera CDH 5.1.4 Cloudera CDH 5.1.5 Cloudera CDH 5.2.0 Cloudera CDH 5.2.1 Cloudera CDH 5.2.2 Cloudera CDH 5.2.3 Cloudera CDH 5.2.4 Cloudera CDH 5.2.5 Cloudera CDH 5.2.6 Cloudera CDH 5.3.0 Cloudera CDH 5.3.1 Cloudera CDH 5.3.2 Cloudera CDH 5.3.3 Cloudera CDH 5.3.4 Cloudera CDH 5.3.5 Cloudera CDH 5.3.6 Cloudera CDH 5.3.7 Cloudera CDH 5.3.8 Cloudera CDH 5.3.9 Cloudera CDH 5.3.10 Cloudera CDH 5.4.0 Cloudera CDH 5.4.1 Cloudera CDH 5.4.2 Cloudera CDH 5.4.3 Cloudera CDH 5.4.4 Cloudera CDH 5.4.5 Cloudera CDH 5.4.6 Cloudera CDH 5.4.7 Cloudera CDH 5.4.8 Cloudera CDH 5.4.9 Cloudera CDH 5.4.10 Cloudera CDH 5.4.11 Cloudera CDH 5.5.0 Cloudera CDH 5.5.1 Cloudera CDH 5.5.2 Cloudera CDH 5.5.3 Cloudera CDH 5.5.4 Cloudera CDH 5.5.5 Cloudera CDH 5.5.6 Cloudera CDH 5.6.0 Cloudera CDH 5.6.1	48

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

References

https://docs.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#tsb_165