CVE-2018-20091: SQL Injection
An SQL injection vulnerability was found in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. This would allow any authenticated user to run arbitrary queries against CDSW's internal database. The database contains user contact information, encrypted CDSW passwords (in the case of local authentication), API keys, and stored Kerberos keytabs.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2018-20091.
What is the severity level of CVE-2018-20091?
The severity level of CVE-2018-20091 is critical with a severity value of 9.9.
What is the affected software of CVE-2018-20091?
The affected software of CVE-2018-20091 is Cloudera Data Science Workbench (CDSW) versions 1.4.0 through 1.4.2.
What is the impact of CVE-2018-20091?
The vulnerability allows any authenticated user to run arbitrary queries against CDSW's internal database, potentially accessing user contact information and encrypted CDSW passwords.
Is there any fix or patch available for CVE-2018-20091?
Yes, Cloudera has released a security bulletin that provides details on how to fix the SQL injection vulnerability in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2.