Apache Knox CVE-2017-5646 User Impersonation Vulnerability

Bugtraq ID:	98739
Class:	Design Error
CVE:	CVE-2017-5646
Remote:	Yes
Local:	No
Published:	May 26 2017 12:00AM
Updated:	May 26 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Apache Knox 0.11 Apache Knox 0.10 Apache Knox 0.9 Apache Knox 0.8 Apache Knox 0.7 Apache Knox 0.6 Apache Knox 0.5 Apache Knox 0.4 Apache Knox 0.3 Apache Knox 0.2
Not Vulnerable:	Apache Knox 0.12

Apache Knox CVE-2017-5646 User Impersonation Vulnerability

Apache Knox is prone to a user-impersonation vulnerability.

An attacker can exploit this issue to impersonate arbitrary users. This may aid in further attacks.

Apache Knox 0.2.0 through 0.11.0 are vulnerable.

Apache Knox CVE-2017-5646 User Impersonation Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Knox CVE-2017-5646 User Impersonation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apache Knox CVE-2017-5646 User Impersonation Vulnerability

References:

• Apache Homepage (Apache)
  
• Apache Knox Product Page (Apache)
  
• Release 0.12.0 Apache Knox (Apache)
  
• CVE-2017-5646: Apache Knox Impersonation Issue for WebHDFS (Apache)