QID 375340

Date Published: 2021-03-26

QID 375340: HPE Ezmeral Data Fabric (MapR) Credentials Impersonation Vulnerability

MapR credentials can be compromised allowing the user to
escalate their privileges to act as any other user, including cluster administrators.
Impact on MapR users: All users who have enabled security on the
MapR platform are impacted and need to apply the appropriate patch

Affected Products:
All versions of MapR up to ver 6.0.1 are affected. Note: All users who have enabled security on the MapR platform are the only impacted.
Potential detection as cannot confirm whether security feature on MapR platform is enabled or not.

QID Detection Logic:
This authenticated QID fetches the version of XStream library if it is installed via the package manager
on Unix based operating systems with commands such as dpkg -l and rpm -qa.

On successful exploit the attacker can escalate privileges.

CVSS V3 rated as Critical - 8.8 severity.

CVSS V2 rated as Medium - 4 severity.

Solution

Apply the appropriate patch provided or the later one that replaces it : v5.2.0-EBF 20190312163159 and later. v5.2.1-EBF 20180731093831 and later. v5.2.2-EBF 20180802011430 and later. v6.0.0-EBF 20180802011420 and later. v6.0.1-EBF 20180806214919 and later.

Vendor References

MapR - support.datafabric.hpe.com/s/article/MapR-Ticket-Credentials-can-become-compromised?language=en_US

CVEs related to QID 375340

CVE-2018-15804 |

Software Advisories

Advisory ID	Software	Component	Link
Mapr	Linux		support.datafabric.hpe.com/s/article/MapR-Ticket-Credentials-can-become-compromised?language=en_US

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].