CVE-2018-11764

Name of the Vulnerable Software and Affected Versions: Apache Hadoop versions 3.0.0-alpha4 through 3.0.0

Description: The web endpoint authentication check in Apache Hadoop is broken, allowing authenticated users to impersonate any user, even if no proxy user is configured.

Recommendations: For Apache Hadoop versions 3.0.0-alpha4 through 3.0.0, consider restricting access to the web endpoint until a fix is available. As a temporary workaround, review and limit user permissions to minimize the risk of impersonation.