CVE-2015-7430 Missing authorization in n/a
Local users can read or write arbitrary GPFS data due to missing authorization checks in the Hadoop connector.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-7430?
CVE-2015-7430 is a high-severity missing authorization vulnerability in n/a, published on 2 Jan 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Hadoop connector 1.1.1, 2.4, 2.5, and 2.7.0-0 before 2.7.0-3 for IBM Spectrum Scale and General Parallel File System (GPFS) allows local users to read or write to arbitrary GPFS data via unspecified vectors.
Weakness: CWE-264
Which versions are affected by CVE-2015-7430?
It affects 1 product.
Products include Apache Hadoop.
How do I fix CVE-2015-7430?
No fix has been published for CVE-2015-7430 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2015-7430 being exploited?
There is no known exploitation of CVE-2015-7430 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2022-25168 Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
- CVE-2021-37404 Heap buffer overflow in libhdfs native library
- CVE-2022-26612 Arbitrary file write in FileUtil#unpackEntries on Windows
- CVE-2019-17195 Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT
- CVE-2017-15718 Exposure of Sensitive Information in Hadoop
Sources
Also known as GHSA-4m44-hx9f-xjfm.