What is CVE-2015-2263?

CVE-2015-2263 is a low-severity vulnerability in Cloudera Manager, classified under CWE-264. CVSS score: 3.3/10. Published 2017-03-23.

How severe is CVE-2015-2263?

Low severity. CVSS v3 base score is 3.3 out of 10.

Vulnerability in Cloudera Manager

CVE-2015-2263

Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the files, as demonstrated by yarn.keytab or ssl-server.xml in /var/run/cloudera-scm-agent/process.

EPSS: 0.003 (20.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Cloudera Cloudera_manager — versions 4.0.0, 4.0.1, 4.0.2
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2015-2263?: CVE-2015-2263 is a low-severity vulnerability in Cloudera Manager, classified under CWE-264. CVSS score: 3.3/10. Published 2017-03-23.
How severe is CVE-2015-2263?: Low severity. CVSS v3 base score is 3.3 out of 10.