CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2018-6185
https://notcve.org/view.php?id=CVE-2018-6185
07 Jun 2019 — In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undelete API calls on encryption zone keys. The Navigator Key Trustee KMS includes 2 API calls in addition to those in Apache Hadoop KMS: purge and undelete. The KMS ACL values for these commands are keytrustee.kms.acl.PURGE and keytrustee.kms.acl.UNDELETE respectively. The default value for the ACLs in Key Trustee KMS 5.12.0 and 5.13.0 is "*" which allows anyone with knowledge of the name of a... • https://www.cloudera.com • CWE-310: Cryptographic Issues •
CVSS: 3.5EPSS: 0%CPEs: 12EXPL: 0CVE-2015-4078
https://notcve.org/view.php?id=CVE-2015-4078
23 Mar 2017 — Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). Cloudera Navigator 2.2.x en versiones anteriores a 2.2.4 y 2.3.x en versiones anteriores a 2.3.3 incluyen soporte para SSLv3 cuando está configurado para utilizar SSL/TLS, lo que hace más fácil a atacantes man-in-the-middle obtener datos en tex... • https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_o1q_wrm_js • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •