CVE-2016-4947: Infoleak
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.
Other sources
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4947?
CVE-2016-4947 is considered a medium severity vulnerability due to its ability to allow remote attackers to enumerate user accounts.
How do I fix CVE-2016-4947?
To fix CVE-2016-4947, you should upgrade Cloudera HUE to version 3.10.0 or later.
What systems are affected by CVE-2016-4947?
CVE-2016-4947 affects Cloudera HUE versions up to and including 3.9.0.
What can attackers do with CVE-2016-4947?
Attackers exploiting CVE-2016-4947 are able to enumerate user accounts, potentially gathering sensitive user information.
Is CVE-2016-4947 a known issue in Cloudera HUE?
Yes, CVE-2016-4947 is a documented vulnerability in Cloudera HUE that was discovered in 2016.