CVE-2012-2230: Medium severity cloudera manager vulnerability
Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote authenticated users to impersonate arbitrary user accounts via unspecified vectors, a different vulnerability than CVE-2012-1574.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2230?
CVE-2012-2230 is rated as a medium severity vulnerability due to its potential for user impersonation in Cloudera Manager.
How do I fix CVE-2012-2230?
You can fix CVE-2012-2230 by upgrading to Cloudera Manager version 3.7.5 or later.
Which versions of Cloudera Manager are affected by CVE-2012-2230?
CVE-2012-2230 affects Cloudera Manager versions 3.7.0 to 3.7.4 and Cloudera Service and Configuration Manager version 3.5.
Can remote users exploit CVE-2012-2230 without authentication?
No, exploitation of CVE-2012-2230 requires remote authenticated user access.
What protections are in place if Kerberos is enabled regarding CVE-2012-2230?
If Kerberos is enabled, the threat of CVE-2012-2230 is mitigated, as the vulnerability specifically arises when Kerberos is disabled.