Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/55062?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55062?format=api", "vulnerability_id": "VCID-qwzh-r4an-rubv", "summary": "Apache Hadoop allows impersonation of arbitrary cluster user accounts\nThe Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.", "aliases": [ { "alias": "CVE-2012-1574" }, { "alias": "GHSA-c6f9-4pmv-m7m6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/181584?format=api", "purl": "pkg:maven/org.apache.hadoop/hadoop-main@0.23.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9wd5-xmya-xug6" }, { "vulnerability": "VCID-j858-d38m-vfhc" }, { "vulnerability": "VCID-kt1w-97bw-r7bp" }, { "vulnerability": "VCID-zjq7-gsc9-y7ep" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-main@0.23.3" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/993499?format=api", "purl": "pkg:maven/org.apache.hadoop/hadoop-main@0.23", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-qwzh-r4an-rubv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-main@0.23" }, { "url": "http://public2.vulnerablecode.io/api/packages/181583?format=api", "purl": "pkg:maven/org.apache.hadoop/hadoop-main@0.23.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9wd5-xmya-xug6" }, { "vulnerability": "VCID-j858-d38m-vfhc" }, { "vulnerability": "VCID-kt1w-97bw-r7bp" }, { "vulnerability": "VCID-qwzh-r4an-rubv" }, { "vulnerability": "VCID-zjq7-gsc9-y7ep" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-main@0.23.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/993500?format=api", "purl": "pkg:maven/org.apache.hadoop/hadoop-main@1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-qwzh-r4an-rubv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-main@1.0" } ], "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2012-1574", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00461", "scoring_system": "epss", "scoring_elements": "0.64111", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00461", "scoring_system": "epss", "scoring_elements": "0.64196", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00461", "scoring_system": "epss", "scoring_elements": "0.64185", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00461", "scoring_system": "epss", "scoring_elements": "0.6415", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00461", "scoring_system": "epss", "scoring_elements": "0.64178", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00461", "scoring_system": "epss", "scoring_elements": "0.64189", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00461", "scoring_system": "epss", "scoring_elements": "0.64177", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00461", "scoring_system": "epss", "scoring_elements": "0.64067", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00461", "scoring_system": "epss", "scoring_elements": "0.64124", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00461", "scoring_system": "epss", "scoring_elements": "0.64161", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00461", "scoring_system": "epss", "scoring_elements": "0.64151", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-1574" }, { "reference_url": "https://github.com/apache/hadoop", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/apache/hadoop" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1574", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1574" }, { "reference_url": "https://seclists.org/fulldisclosure/2012/Apr/70", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://seclists.org/fulldisclosure/2012/Apr/70" }, { "reference_url": "https://web.archive.org/web/20120720041621/https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin#ClouderaSecurityBulletin-MapReducewithSecurity", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20120720041621/https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin#ClouderaSecurityBulletin-MapReducewithSecurity" }, { "reference_url": "https://web.archive.org/web/20151001135054/http://archives.neohapsis.com/archives/bugtraq/2012-04/0051.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20151001135054/http://archives.neohapsis.com/archives/bugtraq/2012-04/0051.html" }, { "reference_url": "https://web.archive.org/web/20161215212154/https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#topic_1_0_2", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20161215212154/https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#topic_1_0_2" }, { "reference_url": "https://web.archive.org/web/20200229125105/http://www.securityfocus.com/bid/52939", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20200229125105/http://www.securityfocus.com/bid/52939" }, { "reference_url": "https://github.com/advisories/GHSA-c6f9-4pmv-m7m6", "reference_id": "GHSA-c6f9-4pmv-m7m6", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-c6f9-4pmv-m7m6" } ], "weaknesses": [ { "cwe_id": 287, "name": "Improper Authentication", "description": "When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct." }, { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 310, "name": "Cryptographic Issues", "description": "Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qwzh-r4an-rubv" }