CVE-2015-4078

LOW

Cloudera Navigator 2.2.x < 2.2.4 and 2.3.x < 2.3.3 - Exposure of Sensitive Information via SSLv3 Padding Oracle Attack

Title source: llm

Description

Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_o1q_wrm_js

Scores

CVSS v3 3.1

EPSS 0.0051

EPSS Percentile 39.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (12)

cloudera/cloudera_manager 5.3.0

cloudera/cloudera_manager 5.3.1

cloudera/cloudera_manager 5.3.2

cloudera/cloudera_manager 5.3.3

cloudera/cloudera_manager 5.4.0

cloudera/cloudera_manager 5.4.1

cloudera/navigator 2.2.0

cloudera/navigator 2.2.1

cloudera/navigator 2.2.2

cloudera/navigator 2.2.3

... and 2 more

Published Mar 23, 2017

Tracked Since Feb 18, 2026