CVE-2014-8733: Infoleak
Cloudera Manager 5.2.0, 5.2.1, and 5.3.0 stores the LDAP bind password in plaintext in unspecified world-readable files under /etc/hadoop, which allows local users to obtain this password.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability CVE-2014-8733?
CVE-2014-8733 is a vulnerability in Cloudera Manager versions 5.2.0, 5.2.1, and 5.3.0 that allows local users to read the LDAP bind password stored in plaintext.
What is the severity of CVE-2014-8733?
CVE-2014-8733 is considered a high severity vulnerability due to the exposure of sensitive credentials.
How do I fix CVE-2014-8733?
To fix CVE-2014-8733, ensure that the LDAP bind password is stored securely and restrict access to configuration files under /etc/hadoop.
Which versions of Cloudera Manager are affected by CVE-2014-8733?
CVE-2014-8733 affects Cloudera Manager versions 5.2.0, 5.2.1, and 5.3.0.
Can I mitigate the risk of CVE-2014-8733 without upgrading?
Yes, you can mitigate the risk of CVE-2014-8733 by changing file permissions and hiding LDAP bind passwords from unauthorized users.