Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Template Name field when renaming a template; (2) KDC Server host, (3) Kerberos Security Realm, (4) Kerberos Encryption Types, (5) Advanced Configuration Snippet (Safety Valve) for [libdefaults] section of krb5.conf, (6) Advanced Configuration Snippet (Safety Valve) for the Default Realm in krb5.conf, (7) Advanced Configuration Snippet (Safety Valve) for remaining krb5.conf, or (8) Active Directory Account Prefix fields in the Kerberos wizard; or (9) classicWizard parameter to cmf/cloudera-director/redirect.
References
Configurations
History
No history.
Information
Published : 2017-03-07 16:59
Updated : 2024-02-28 15:44
NVD link : CVE-2016-4948
Mitre link : CVE-2016-4948
CVE.ORG link : CVE-2016-4948
JSON object : View
Products Affected
cloudera
- manager
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')