PT-2015-5463

CVE-2015-1836

Published

2015-12-21

Updated

2018-10-18

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache HBase versions 0.98 through 0.98.12.0 Apache HBase versions 1.0 through 1.0.1.0 Apache HBase versions 1.1 through 1.1.0.0

Description The issue allows remote attackers to cause a denial of service, obtain sensitive information, or modify data via unspecified client traffic due to incorrect ACLs for ZooKeeper coordination state.

Recommendations For Apache HBase versions 0.98 through 0.98.12.0, update to version 0.98.12.1 or later. For Apache HBase versions 1.0 through 1.0.1.0, update to version 1.0.1.1 or later. For Apache HBase versions 1.1 through 1.1.0.0, update to version 1.1.0.1 or later.

Exploitability

Fix

Impacts

Researchers

Enis Söztutar

Paul Codding

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers

CVE-2015-1836