Cloudera Manager =< 5.5 is vulnerable to an access control issue allowing any user to access any process logs, on standard output and error descriptors, with the following GET request:
```
http://<cloudera_manager_IP>:7180/cmf/process/<process_id>/logs?filename={stderr,stdout}.log
```
The prerequisite to exploit this vulnerability is to know (or iterate) the targeted process identifier.
The impact of the vulnerability is that a poorly developed process might contain sensitive information.
The Cloudera CERT indicated that this vulnerability is fixed in version 5.8.
暂无评论