{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39317?format=json","vulnerability_id":"VCID-ryz9-55qq-cyd9","summary":"Information Exposure\nVulnerability in Apache Hadoop allows a cluster user to expose private files owned by the user running the `MapReduce` job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the `MapReduce` job history server host.","aliases":[{"alias":"CVE-2017-15713"},{"alias":"GHSA-3v44-382q-55f4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54873?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-common@2.8.3","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-common@2.8.3"},{"url":"http://public2.vulnerablecode.io/api/packages/53663?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-common@3.0.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-common@3.0.1"},{"url":"http://public2.vulnerablecode.io/api/packages/54938?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-main@2.7.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-371e-cg9e-tydr"},{"vulnerability":"VCID-66vn-51hs-kudx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-main@2.7.5"},{"url":"http://public2.vulnerablecode.io/api/packages/57231?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-main@2.8.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-371e-cg9e-tydr"},{"vulnerability":"VCID-66vn-51hs-kudx"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-main@2.8.3"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54865?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-common@0.23.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-e4bh-g4w9-huax"},{"vulnerability":"VCID-ryz9-55qq-cyd9"},{"vulnerability":"VCID-wph5-16hk-jkbj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-common@0.23.0"},{"url":"http://public2.vulnerablecode.io/api/packages/54866?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-common@0.23.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-e4bh-g4w9-huax"},{"vulnerability":"VCID-ryz9-55qq-cyd9"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-common@0.23.11"},{"url":"http://public2.vulnerablecode.io/api/packages/54867?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-common@2.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-e4bh-g4w9-huax"},{"vulnerability":"VCID-ryz9-55qq-cyd9"},{"vulnerability":"VCID-wph5-16hk-jkbj"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-common@2.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/54868?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-common@2.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ryz9-55qq-cyd9"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-common@2.0.6"},{"url":"http://public2.vulnerablecode.io/api/packages/54869?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-common@2.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ryz9-55qq-cyd9"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-common@2.1.0"},{"url":"http://public2.vulnerablecode.io/api/packages/54870?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-common@2.1.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ryz9-55qq-cyd9"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-common@2.1.1"},{"url":"http://public2.vulnerablecode.io/api/packages/54871?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-common@2.2.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5cvy-3bve-xkg7"},{"vulnerability":"VCID-ryz9-55qq-cyd9"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-common@2.2.0"},{"url":"http://public2.vulnerablecode.io/api/packages/54872?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-common@2.8.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-ryz9-55qq-cyd9"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-common@2.8.2"},{"url":"http://public2.vulnerablecode.io/api/packages/53661?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-common@3.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-bvx1-94m9-7ygh"},{"vulnerability":"VCID-e4bh-g4w9-huax"},{"vulnerability":"VCID-ryz9-55qq-cyd9"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-common@3.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/57230?format=json","purl":"pkg:maven/org.apache.hadoop/hadoop-main@2.8.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-66vn-51hs-kudx"},{"vulnerability":"VCID-ryz9-55qq-cyd9"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.hadoop/hadoop-main@2.8.0"}],"references":[{"reference_url":"https://lists.apache.org/thread.html/a790a251ace7213bde9f69777dedb453b1a01a6d18289c14a61d4f91@%3Cgeneral.hadoop.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/a790a251ace7213bde9f69777dedb453b1a01a6d18289c14a61d4f91@%3Cgeneral.hadoop.apache.org%3E"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15713","reference_id":"CVE-2017-15713","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15713"},{"reference_url":"https://github.com/advisories/GHSA-3v44-382q-55f4","reference_id":"GHSA-3v44-382q-55f4","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-3v44-382q-55f4"}],"weaknesses":[{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."},{"cwe_id":200,"name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."}],"exploits":[],"severity_range_score":null,"exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ryz9-55qq-cyd9"}